It's funny that you flagged this issue because spent many, many hours on this exact problem... the existing Wireguard + VPS solutions were too difficult. I came up with a solution using Docker... which is still pretty complicated... but at least does not require the user to run iptables commands directly on any machine....