Only thing stopping me from setting up an Rpi on wireguard as a VPN bridge (I'm using mullvad's excellent application) is that so far I haven't been able to successfully set up the firewall so that all traffic gets into wg0 except for ssh, with which I connect to in SOCKS5 proxy (from work). Some sort of split tunnel.