Firewall rules to allow connected WG peer access out to WAN

[beneix]

I must admit that no matter how much I read about firewall rules, it never becomes intuitive or clear to me...so please, if anyone can help me here.

I have a working Wireguard set-up so that I can access my OPNSense router at home from any external location. When I connect, I get access to the LAN, I can manage my router and I can access my NAS via the LAN. However, I cannot access the WAN. I assume I need to add some rule to the firewall, but I really can't figure out how this rule should be defined.

I have attached screenshots of the existing rules for Wireguard and Wireguard (group).

[Patrick M. Hausen]

What's in your "AllowedIPs" on the client side?

[beneix]

In the client peer definition, it's 0.0.0.0/0. On the OPNSense side, it's 192.168.5.2/32.

[Patrick M. Hausen]

Looks good as do your rules. I'd bring the big tools - packet trace/tcpdump.