diff --git a/rootfs/etc/wireguard/wg0.conf b/rootfs/etc/wireguard/wg0.conf
index 7ce1e6a..1856e7b 100644
--- a/rootfs/etc/wireguard/wg0.conf
+++ b/rootfs/etc/wireguard/wg0.conf
@@ -6,13 +6,24 @@ PostUp = [ -e '/etc/wireguard/%i-privatekey' ] || (umask 077 && wg genkey > '/et
 PostUp = [ -e '/etc/wireguard/%i-publickey'  ] || (umask 022 && wg pubkey < '/etc/wireguard/%i-privatekey' > '/etc/wireguard/%i-publickey')
 PostUp = wg set '%i' private-key '/etc/wireguard/%i-privatekey'
 # Load peers
-PostUp = [ -e '/etc/wireguard/%i-peers.conf' ] && wg addconf '%i' '/etc/wireguard/%i-peers.conf'
-# Store the internet-facing interface in a file for later use
-PostUp = ip route show default | awk '/^default/{print $5}' > '/etc/wireguard/%i-iface'
+PostUp = [ -e '/etc/wireguard/%i-peers.conf' ] || (umask 022 && touch '/etc/wireguard/%i-peers.conf')
+PostUp = wg addconf '%i' '/etc/wireguard/%i-peers.conf'
 # Enable IPv4/IPv6 forwarding
 PostUp = grep -Fxq '1' /proc/sys/net/ipv4/ip_forward              || printf 1 > /proc/sys/net/ipv4/ip_forward
 PostUp = grep -Fxq '1' /proc/sys/net/ipv6/conf/all/forwarding     || printf 1 > /proc/sys/net/ipv6/conf/all/forwarding
 PostUp = grep -Fxq '1' /proc/sys/net/ipv6/conf/default/forwarding || printf 1 > /proc/sys/net/ipv6/conf/default/forwarding
+# Store the internet-facing interface in a file for later use
+PostUp = ip route show default | awk '/^default/{print $5}' > '/etc/wireguard/%i-iface'
+# Allow access WireGuard via port 51820/UDP on the internet-facing interface
+PostUp   = iptables  -A INPUT -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 51820 -j ACCEPT
+PostUp   = ip6tables -A INPUT -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 51820 -j ACCEPT
+PostDown = iptables  -D INPUT -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 51820 -j ACCEPT
+PostDown = ip6tables -D INPUT -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 51820 -j ACCEPT
+# Allow access WireGuard via port 53/UDP on the internet-facing interface (to circumvent some firewalls)
+PostUp   = iptables  -t nat -A PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820
+PostUp   = ip6tables -t nat -A PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820
+PostDown = iptables  -t nat -D PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820
+PostDown = ip6tables -t nat -D PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820
 # Allow packet forwarding on the WireGuard interface
 PostUp   = iptables  -A FORWARD -i '%i' -j ACCEPT && iptables  -t nat -A POSTROUTING -o "$(cat '/etc/wireguard/%i-iface')" -j MASQUERADE
 PostUp   = ip6tables -A FORWARD -i '%i' -j ACCEPT && ip6tables -t nat -A POSTROUTING -o "$(cat '/etc/wireguard/%i-iface')" -j MASQUERADE
@@ -23,8 +34,3 @@ PostUp   = iptables  -A INPUT -i '%i' -p tcp --dport 53 -j ACCEPT && iptables  -
 PostUp   = ip6tables -A INPUT -i '%i' -p tcp --dport 53 -j ACCEPT && ip6tables -A INPUT -i '%i' -p udp --dport 53 -j ACCEPT
 PostDown = iptables  -D INPUT -i '%i' -p tcp --dport 53 -j ACCEPT && iptables  -D INPUT -i '%i' -p udp --dport 53 -j ACCEPT
 PostDown = ip6tables -D INPUT -i '%i' -p tcp --dport 53 -j ACCEPT && ip6tables -D INPUT -i '%i' -p udp --dport 53 -j ACCEPT
-# Allow access WireGuard via port 53/UDP (to circumvent some firewalls)
-PostUp   = iptables  -t nat -A PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820
-PostUp   = ip6tables -t nat -A PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820
-PostDown = iptables  -t nat -D PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820
-PostDown = ip6tables -t nat -D PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820
diff --git a/start-qemu.sh b/start-qemu.sh
index 89348b5..e65e958 100755
--- a/start-qemu.sh
+++ b/start-qemu.sh
@@ -29,6 +29,6 @@ kvm \
 	-smp 1 -m 512 \
 	-nographic -serial mon:stdio \
 	-device e1000,netdev=n0 \
-	-netdev user,id=n0,hostfwd=tcp::2222-:22,hostfwd=udp::5353-:53 \
+	-netdev user,id=n0,hostfwd=tcp::2222-:22,hostfwd=udp::51820-:51820 \
 	-drive file="${SNAPSHOT_DISK:?}",if=virtio,format=qcow2 \
 	-drive file="${USERDATA_DISK:?}",if=virtio,format=raw
diff --git a/wireguard.pkr.hcl b/wireguard.pkr.hcl
index 8bc3fe2..1bbd967 100644
--- a/wireguard.pkr.hcl
+++ b/wireguard.pkr.hcl
@@ -107,8 +107,7 @@ build {
       "ufw --force enable",
       "ufw default deny incoming",
       "ufw default allow outgoing",
-      "ufw allow from any to any port 22 proto tcp",
-      "ufw allow from any to any port 51820 proto udp"
+      "ufw allow from any to any port 22 proto tcp"
     ]
   }