I tried all sorts of port forwarding tricks to get wireguard working on the VM that runs my HA instance to no avail. The trailscale solution works really well. The only real problem I had was magic DNS conflicts with DNS66 on my phone (which I use for ad blocking). In the end I just used a hardwired VPN IP for my HA connection.