# at least `net.ipv4.ip_forward = 1` is needed for wireguard masquerade? to work
# ka seems has this as default, maybe arch linux cloud-init image has this as default?
# https://forums.rockylinux.org/t/wireguard-masquerade-wont-work/7752
# https://wiki.archlinux.org/title/Nftables#NAT_with_port_forwarding
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1