Someone might suggest something more elegant but one solution is a managed switch which every devices traffic passes through, then allocate one port as a trunk port and connect that to wireguard on your server?