WireGuard Port Forwarding & Static DDNS (CGNAT Bypass) NOIP

I already have a working WireGuard tunnel between my Linux VPS (server) and a Cudy 5 G router (client) that successfully gets me past the carrier’s CGNAT. Now I want to drop a DrayTek router running DrayOS behind the Cudy and expose it cleanly to the outside world.

During a short AnyDesk / Zoom session I need you to:

• Cable and route the DrayTek behind the Cudy so it sits logically on the WireGuard side of the network.
• Create precise port-forward rules on the Cudy that push TCP 443, TCP 1723 and UDP 500, 4500, 1701 straight through to the DrayTek with no double-NAT surprises.
• Lock my existing No-IP host to one static address and disable its auto-update feature.
• Confirm from an external connection that both the DrayTek Web GUI and Smart VPN service are reachable and stable.

My priority is to bypass CGNAT effectively while keeping both Web GUI access and Smart VPN fully operational. You should already be comfortable with Linux routing, WireGuard, and DrayTek configuration. IP details and domain credentials will be shared privately once we start.