Three-point VPN Gateway. WireGuard, IPTables/NFTables, DNS, dnsmasq. VPN server and Internet gateway on different machines.

Physical one-way data link. 100Mbps ethernet + UDP/IP. File transfer with ncat or socat and tar.