Earlier quoted context omitted.
My personal opinion is going with ZeroTier instead, had more trouble with wireguard then its worth (V likely issue on our end, Ds-lite users couldn't connect, handshakes not working until wireguard server /firewall restarts etc) meanwhile ZeroTier was on all devices 0 setup apart of setting dns servers (+ busted through all firewalls the users had /corporate it's)
I can't figure out how it works, any links?
Do you mean this? https://www.zerotier.com/manual/