I have a fleet of small battery powered temperature sensors that send readings to a backend built with it. On the sensors, I’m using the vanilla WireGuard-ESP library to connect over Wi-Fi to the backend (full tunnel). So the IP for the device is assigned like normal, the the tunnel is established. The sensor also needs to pull time (NTP) over the tunnel. So it talks to two different “IPs” that are completely virtual. At the other end of the tunnel the packets are inspected in the Lambda and if they match one of the two magic IPs, things happen (temperature stored or NTP response). The Lambda function does all that work (there is no real NTP server).
Another example is what I call CoAP/wg where raw CoAP requests are sent by a client application. By raw I mean what goes over the tunnel isn’t encapsulated IP, it’s just plain CoAP. In that case the backend just handles it like any other CoAP implementation would since the UDP Gateway terminates the encryption/tunnel. This isn’t a tunnel in the networking sense but it uses the same backend as the temp sensor example.
It’s a weird tool, but a really nice one IMHO.