I wanted to share a service I'm hosting, but didn't feel comfortable just leaving publicly accessible, even behind a reverse proxy. In the meantime I did not want to give access to my whole lan with a VPN, or redirect all internet traffic from a client thru my network. So the idea is to run a WireGuard instance on my OpenWRT router in a completely isolated zone (input, output and forward set to reject on firewall) and then forward a single port from the service host's. Client is android, so using WG Tunnel and split tunnel just for the relevant app should not impair client's network access. Initial tests seems to be ok, is there anything I may have overlooked? Please feel free to comment.
Tailscale would probably be easier for this. Install tailscale on the server and configure only that service available in the tailscale dashboard. I've used this method for ssh access to family members devices.
I'm sure you could run the same setup using headscale (tailscale self hosted), it would require a bit more setup though and dynamic dns would probably have to be working.
I know about Tailscale, but since it's a commercial service I'm not keen to adopt it and then maybe they stop having a free tier. I'll look into Headscale instead, I did not know about that before.