The address is going to be static: I'm not aware of a way to simulate privacy extensions with Wireguard. A workaround is to assign ULAs and apply NAT.
------------------
[Interface] Address = 172.16.31.1/24 Address = 2001:__::1/64 PrivateKey = __ ListenPort = 443
[Peer] PublicKey = __ PresharedKey = __ AllowedIPs = 172.16.31.2/32, 2001:__::2/128
[Peer] PublicKey = __ PresharedKey = __ AllowedIPs = 172.16.31.3/32, 2001:__::3/128
[...]
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -A FORWARD -i %i -j ACCEPT; ip6tables -A FORWARD -o %i -j ACCEPT PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i %i -j ACCEPT; ip6tables -D FORWARD -o %i -j ACCEPT
[Interface] Address = 172.16.31.2/24 Address = 2001:__::2/64 PrivateKey = __ DNS = 172.16.31.1, 2001:__::1 [Peer] PublicKey = __ PresharedKey = __ AllowedIPs = 0.0.0.0/0, ::/0 Endpoint = <server_ip>:443 PersistentKeepalive = 25
The address is going to be static: I'm not aware of a way to simulate privacy extensions with Wireguard. A workaround is to assign ULAs and apply NAT.