Using a wireguard vpn concentrator “works”, but it has limitations like having a higher chance of interfering with access to the the local network while connect

Using a wireguard vpn concentrator “works”, but it has limitations like having a higher chance of interfering with access to the the local network while connected. (Because the private addresses the remote network is using have a reasonable chance of clashing with the addresses on the local network.) Also, you absolutely need either port forwarding (or other forms of static NAT mapping) for the concentrator, or to run the concentrator outside of the NAT. (Which might be by running the software on the router that does NAT, or a seperate device with a routable address). Setting up vpn concentration solutions that limit your network access to only specific devices depending on who you sign in as is often quite complicated, to the point where I rarely see it done well. Often if you are you are connected, you get full access to several corporate subnets, and you are mostly limited by things like router acls not allowing VPN connections direct access to the some production subnets.