In the wireguard config section of their tutorials, there’s a spot to put a custom port - it’s really unclear from the docs but this allows you to expose out a service within the higher limits of the port ranges, and only on dedicated servers.

Really hard to find but they call this “city ports” over global ports because you have to set them up beforehand.