skz-wg bundles WireGuard, Unbound, and pf into a repeatable OpenBSD deployment.
Features
- Declarative peers with QR codes for quick mobile onboarding.
- Split-tunnel or full-tunnel setups with matching DNS overrides.
- pf(4) rules that block leaks in either direction and provide optional outbound filtering.