Wireguard listens on UDP. So on regular home network with NAT you'd port forward it's UDP port from your router to which ever device is running it. This could

Wireguard listens on UDP. So on regular home network with NAT you'd port forward it's UDP port from your router to which ever device is running it. This could indeed be the same Raspberry Pi. The main points are: Wireguard uses fairly strong and trusted encryption; this is basically shown by the fact it managed to be mainlined. It's basically foolproof, you don't have a myriad of options to choose from that can lead to insecure configuration. It's faster than OpenVPN and less complicated then IPSec. It's easy to tunnel all traffic or just a subset through the VPN. It should deal with roaming IP addresses fairly well (so works on a train as well as your net will). Basically, if the only open port from the internet to your LAN is wireguard, you're probably not going to be breached by someone coming in the front door. Obviously, if you open a cat.jpeg.exe when on you're network, your inbound firewall security is no longer going to be helping you, however there are also ways around this. I.E. you could segregate your desktop and phones from the main network, etc. But then a rouge IOT device that does need to connect to your homeassistant could cause problems, and you probably want some access too, so you probably want to setup some kind of auth... Yeah, I guess it can get convoluted if you're not happy with some risk / work...