UDP: VoIP, games, WireGuard, DNS

Same as TCP, with UDP's own caveats.

Open the range on the server

/etc/lnkstart/server.toml

[udp]
ports = "40100-40199"

On the machine that publishes it

lnkstart add vpn=51820 --udp --private
lnkstart add dns=53 --udp --allow 203.0.113.7/32

On the machine you are connecting from

lnkstart connect vpn --udp --port 51820

Opens a local UDP port; the WireGuard client points to 127.0.0.1:51820.

A flow with no traffic is forgotten after a minute: the next packet opens another, and that is normal in UDP.
In UDP the source address can be spoofed, so --allow prevents responses from going to others, but does not prevent someone from sending packets blindly.
That is why a UDP service with --open responds at most a little more than it receives: prevents your server from being used to attack others.