Wireguard Client -> Client not working

[hongkongkiwi]

I'm using the RoadWarrior setup and it's working well.

Wireguard Network:
Tunnel IP - 10.0.10.1/24
Peer IP - 10.0.10.2/24
Allowed Networks - 10.0.10.0/24, 192.168.90.0/24

I would like to access the web interface at 10.0.10.1, but I can't seem to get access to this (either ping or access to the web ui).

I can access the webui using 192.168.90.2 but I want to access it via the Wireguard server ip: 10.0.10.1

When using IP tables i would have the following rule to allow this:
iptables -A FORWARD -i wg0 -o wg0 -j ACCEPT

I couldn't figure out how to get this same functionality in OPNsense. I couldn't any examples of people in the forums wanting wg->wg client functionality.

I've attempted to have a look for dropped packets in the firewall log, but I see nothing related to this interface, it's like the packets just disappear or are silently dropped for 10.0.10.1 (this includes when attempting to use this as the DNS server), using my lan ip for the dns server works just fine.

[hongkongkiwi]

Here's some screenshots of my rules. Everything seems super straightforward except this weird issue.

[Demusman]

You have that IP as your tunnel address. There's no web server running on it, it's just the tunnel.
What web interface are you trying to access?

[hongkongkiwi]

I'm attempting to access the OPNSense web interface, the Unbound DNS server and also ping the wireguard tunnel address.

My understanding is that the "Tunnel Address" is attached to the wireguard adapter, e.g. wg1 on the OPNSense server in my case.

When using the web diagnostics I can ping the tunnel address 10.0.10.1, but from another wireguard client my packets get stopped somewhere. I can access other private networks just fine such as 192.168.90.0/24.

Basically, what I'm trying to do is to have all wireguard clients access each other (10.0.10.0/24) AND have all wireguard clients have access to the OPNSense tunnel address (10.0.10.1). This means that when I'm logged in as a wireguard client I can access the Unbound server on this address and also the OPNSense web gui.

[Demusman]

Ok, I get it now. Misunderstood what you were saying.
Use the packet capture on the WG interface and try to ping from a client.
I'm guessing you'll see the requests but it's not sending replies back to the client.
Might need a static route.