@feld lets replace your WAN IP for your VPS with a name, “Kyle”. WG endpoint can be Bob.
You are asking traffic for Kyle to be accepted by Kyle and then forwarded to Kyle over a tunnel between Kyle and Kyle but it’s actually Bob. You are making this 1000% harder by trying to map your IP to a machine that doesn’t have it by IP address.
You have a few ways to do this:
1. NAT all incoming traffic to the IP address of the machine on the other end of the tunnel(all Kyle goes to Bob)
1/2