as far as the routing for wireguard, that's another topic. You can specify the "endpoint" for the devices, and it will route to that endpoint. So that interface is up to you, but by default netmaker will find the public endpoint of the device. It also does one additional thing, which is if devices are on the same LAN, it will use that as the endpoint between those devices.