And what I like about Wireguard is that you can't port scan for it. The protocol is designed in such a way that the wireguard server won't respond unless you know the right key.