I like some cryptographical guarantees, so my trusted devices get to be on a overlay WireGuard based VPN, and the access from actual ethernet/LAN gets blocked.

I like some cryptographical guarantees, so my trusted devices get to be on a overlay WireGuard based VPN, and the access from actual ethernet/LAN gets blocked. VPN still uses IP/port blocking, but thanks to WireGuard, you can be sure that source IP really matches the device you think it does.