Comment by hdgvhicv

Functionally they are. Allow traffic aiming at this address and this port to arrive on this server.

Not that my WireGuard connection needs nat as it terminates on my router. And I use private ip ranges as I want to be sure that if WireGuard drops out for some reason traffic doesn’t route over the unencrypted path. Defence in depth.