apt install wireguard iptables (nft)

Alles als root:

vi /etc/sysctl.conf

net.ipv4.ip_forward=1   # soll nich auskommentiert ein

sysctl -p

cd /etc/wireguard

umask 077; wg genkey | tee privatekey | wg pubkey > publickey

cd /etc/wireguard

vi wg0.conf

[Interface] 
PrivateKey = <PrivatKey vom Server>
Address = 172.31.0.1/32
SaveConfig = true 
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE
ListenPort = 51820

[Peer]
PublicKey = <PublicKey vom Client>
AllowedIPs = 172.31.0.0/24