Orecle Cloud Instance: Basic wireguard block WAN access

[sovking]

Hello to everyone.
I installed OPNsense (aarch64) on OCI (Ampere One instance) following the various tutorial available on this forum.
The installed VM is on the public subnet 10.0.0.2/24, and it has a public IPv4 and IPv6 address.
Everything went fine: I access the GUI from WAN, ssh from WAN, and I can ping it (by using IPv4).
I was not able to add a secondary interface to connect the private subnet... but that it is not important.

When I try to setup Wireguard, when I enable the WG interface, the WAN interface became unreachble and the only think I can do is access from the console and issue pfctl -d to restore the access.

Any ideas or hint about this behaviour ?

Thanks