@rwg Probably the biggest downside with Wireguard. As long as it works, it's really simple. If something breaks, it can be virtually impossible to debug because *all* failures look the same: there is no usable diagnostic information other than whether or not traffic flows through the tunnel.

Try adding input and output firewall rules respectively matching the remote peer with (in nftables, adjust if necessary) something like "counter accept". See if Wireguard is trying to pass data both ways.

@rwg have you checked that the WireGuard system has the interface set up?