http://ciisqbg45nggykdl6rjdrq3wc64csga4vkphu66qsi65mypeitqedoad.onion/blog/port-striping-v3
OpenVPN or WireGuard won't route arbitrary L4 protocols like GRE, ESP, AH, SCTP, or IGMP — at least, not by default or by design, but just in case a malicious client does somehow figure out a way to route those, and just in case there's some unknown kernel-level or NAT tracking L4 handling vulnerabilities, we explicitly restrict SNAT to UDP, TCP, and ICMP.