[lstodd]

Because stuff that requires this circus of encapsulation is usually so brain-dead that it can't be gotten to work in any other less horrible way.

(also I think you lost one 'over UDP')

[crest]

You're right. I forgot that WireGuard sits on top of UDP.