First of all, the network map:
Campus Network -ethernet-> OpenWRT Router (assigned a public address, connected to a offsite Wireguard peer) -> End devices <