ok so to confirm, for example, if Client A has a wireguard interface with port 12345 open, you need to open 12345 UDP on the security group to the machine, and then it works?