I love this setup:
systemd-networkd: routing all traffic over WireGuard (section)
(this knowledge is cross-linux, not just archlinux, btw ^^)
By leveraging it's built in routing, you don't have to set up nearly as many iptables to open up ports.
WireGuard - ArchWiki
