@graymalk Alright I got it fully working! Here is my attempt at explaining everything I did in case someone else has this problem.

First, I'm using the standalone version. All instructions are for that. Also, my skill level: noob, forced into IT because there's no one else who'll do it.

1) Create a new VLAN. Network -> LAN -> Add.

Name: anything that makes sense

IP Address: something low, but definately a different subnet, like 192.168.100.1 if your primary one was 192.168.0.x.

Subnet mask: 255.255.255.0

Normal

Vlan number: anything not already used

I used DHCP and an address range of 100-199. (so, in this example, 192.168.100.100 to 192.168.100.199)

Enable it (it should already be enabled) and leave everything else blank.

Click OK.

2) Firewall -> Access Control -> Add

Name: erhm I forget now if I was able to type something in or if I had to pick from a list. If I had to pick from a list, I just picked the VLAN name.

Policy: allow

Service Type: all

Direction: LAN->LAN

Source and destination need to match your existing VLAN and LAN

Effective time: any

3) Transmission->NAT->Virtual Servers->Add

Actually I'm not 100% sure if this one was necessary, but I did it and am leaving it and am not going to test it by disabling. Maybe you can try skipping this and if it doesn't work, go back and add it.

Name: anything

Interface: which port your internet is plugged into

External port: the Wireguard listening port (can be a range)

Internal port: the Wireguard listening port (can be a range)

Internal server IP: Make this match whatever you create for Wireguard, eg 192.168.0.2 from the guide.

Protocol: ALL

4) VPN->Wireguard

Actually for this you can follow their guide, but you need to be very careful about which key goes where. I'll just outline the few things that I had to do differently from the guide.

In Peers, I set the IP address to the lowest one in my VLAN range, /32. (eg 192.168.100.100/32). And the endpoint is my PUBLIC IP ADDRESS. I'm stressing that, because IIRC the guide has you putting something weird in.

On the client, put this in:

[Interface]

PrivateKey = <your private key from the client app>

Address = 192.168.100.100/24

DNS = 8.8.8.8

[Peer]

PublicKey = <your public key from the server>

AllowedIPs = all IP addresses you wish to allow (eg 0.0.0.0/0 to tunnel all traffic). My understanding here is less great. I tunneled all traffic. I don't know how to make it be picky.

Endpoint = <your PUBLIC IP or domain>:51820

Lastly, you have to run the client on whatever you plan to log in with. eg if using a laptop via phone, the client has to be on the laptop.

One more thing: if you are using any other levels of firewall internally, you might need to allow traffic from your new VLAN. That was my final hiccup LOL.

Happy Wireguarding!

  @graymalk Oh I forgot. I *also* added the new VLAN under Network->VLAN, but I'm not sure this was necessary. This is just where you can tie a physical port to it. I reduced it to a single port that has nothing plugged into it.