The author is setting up NAT w/ the iptables rule in the POSTROUTING chain that does `-j MASQUERADE`. With that rule in place, combined with `allowed-ips 0.0.0.

The author is setting up NAT w/ the iptables rule in the POSTROUTING chain that does `-j MASQUERADE`. With that rule in place, combined with `allowed-ips 0.0.0.0/0` on the wireguard client, the client can tunnel all their IP traffic through the server as opposed to just having a private subnet setup between the two endpoints.