Three-point VPN Gateway. WireGuard, IPTables/NFTables, DNS, dnsmasq. VPN server and Internet gateway on different machines.