Make connected devices use (Nebula) tunnel interface


I am new to OpenWRT and am struggling to make it do what I expect. I have a Nebula network that I have set up in OpenWRT 22.03 and I believe I have configured it correctly for the Mango to join the network and see the other devices on the Nebula network -- pinging (my "lighthouse") and .102 (my Jellyfin server) from the diagnostics page of Luci work as expected.

It also works as expected for me to connect to the Mango with my laptop and use the internet as normal, so I think I have set up the Wireless AP and Internet access correctly.

I was hoping that I could connect to the Mango with devices (e.g. my Roku) and they would be able to communicate with the devices on the Nebula .42 subnet, but if I connect my laptop to the Mango and ping then it does not work. Can anybody please help me find the problem?

I have been adding random allow rules in the firewall config in Luci and tried creating routing rules, but I do not really know what I am doing and I'm hoping there is an easy solution there that is obvious to someone more familiar with OpenWRT. Can somebody please give me a pointer in the right direction?

More background on Nebula on OpenWRT is here, though I suspect my issue is a more general routing/firewalling/NAT problem than Nebula-specific, given I can ping Nebula devices from the Mango already:

In the future I would like to redirect internet traffic to a Wireguard server I have on my Nebula network, but for now my focus is getting Jellyfin accessible to my Roku.

Many thanks in advance for any help!