Sounds like you have an chicken egg problem with first wireguard Interface. Or do you plan to keep api and grpc open on the public ip? But this means every client need to be able to reach netmaker server via vpn, that might not be possible for all