Firewall for wireguard

**Describe the problem you have/What new integration you would like**
Firewall so clients outside the wireguard VPN can't reach the services on the esp.

**Please describe your use case for this integration and alternatives you've tried:**
When the network is not in your contol so no one can access the esp outside the vpn.
So an option to only expose the web server, api, ota update, etc to the wireguard tunnel would be very appreciated.

**Additional context**

The firewall could also be helpfull for other use cases

The request names no files, tests, or implementation entry points. Start by locating the ESP's WireGuard integration and the web server, API, and OTA service exposure, then define the access policy and how to verify that those services are reachable only through the tunnel.

Written by the indexing model from the issue text.