WG uses UDP, so as long as your firewall is configured correctly it should be impossible to scan the open port. Any packet hitting the open port that isn’t valid or doesn’t have a valid key is just dropped, same as any ports that are closed.
Most modern firewalls default to dropping packets, so you won’t be showing up in scans even with an open WG port.
Yes, but only if your firewall is set to reject instead of drop. The documentation you linked mentions this; that’s why open ports are listed as
open|filtered
because any port that’s “open” might actually be being filtered (dropped).On a modern firewall, an nmap scan will show every port as
open|filtered
, regardless of whether it’s open or not.Edit: Here’s the relevant bit from the documentation: