the wireguard handshakes are over the public ip addresses and udp ports though. thats why i thought it could be related to the 172.x.x.x subnets