I love this setup:
systemd-networkd: routing all traffic over WireGuard (section)
https://wiki.archlinux.org/title/WireGuard
(this knowledge is cross-linux, not just archlinux, btw ^^)
By leveraging it's built in routing, you don't have to set up nearly as many iptables to open up ports.