If you want to really get into it, you can just hose a wireguard instance in a LXC then use iptables for all your routing.

Relies only on FOSS software and gives you a pretty high level of control, but obviously is less intuitive