Wireguard in its own separate zone outside of lan

I'd like to create a second wireguard configuration separate from the lan so that I can control the traffic using a few fine-grained firewall rules.

The problem is that I can't even ping the openwrt fw. The wireguard handshake works and the client even receives the keepalives. Looking at tcpdump I can se traffic going from the client to the firewall, but only keepalive traffic coming out.

# cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdfd:17d7:6e2a::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'
	option ipv6 '0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '10.0.0.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option delegate '0'
	list dns '10.0.0.53'

config interface 'wan'
	option proto 'static'
	option device 'eth1'
	option type 'bridge'
	option ipaddr '192.168.1.3'
	option netmask '255.255.255.0'
	option gateway '192.168.1.1'
	option peerdns '0'
	list dns '217.31.204.130'
	list dns '193.29.206.206'

config interface 'vpn'
	option proto 'wireguard'
	option private_key '...'
	list addresses '10.0.2.1/24'
	option listen_port '51820'
	list dns '10.0.0.53'

config wireguard_vpn 'wgclient'
	option description 'user1'
	option public_key '...'
	option preshared_key '...'
	option persistent_keepalive '25'
	list allowed_ips '10.0.2.2/32'
	option route_allowed_ips '1'
	option endpoint_port '51820'

config device
	option name 'vpn_guests'
	option ipv6 '0'
	option acceptlocal '1'

	config interface 'vpn_guests'
	option proto 'wireguard'
	option private_key '...'
	option listen_port '51821'
	option peerdns '0'
	list dns '10.0.0.53'
	list addresses '10.201.1.1/24'

config wireguard_vpn_guests
	option description 'user1'
	option public_key '...'
	option private_key '...'
	option preshared_key '...'
	option endpoint_port '51821'
	option persistent_keepalive '25'
	list allowed_ips '10.201.1.2/32'
	option route_allowed_ips '1'
# cat /etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option synflood_protect '1'
	option forward 'REJECT'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option masq '1'
	option mtu_fix '1'
	option log '1'
	list network 'wan'
	option forward 'REJECT'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'
	list network 'vpn'
	option log '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config rule 'wg'
	option name 'Allow-WireGuard'
	option src 'wan'
	option dest_port '51820'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.fail2ban'
	option enabled '1'
	option reload '1'

config zone
	option name 'guests'
	option output 'ACCEPT'
	option log '1'
	list network 'vpn_guests'
	option input 'ACCEPT'
	option forward 'REJECT'

config rule
	list proto 'udp'
	option src 'wan'
	option target 'ACCEPT'
	option dest_port '51821'
	option name 'guests | allow wireguard'

config rule
	option name 'guests | allow dns'
	option src 'guests'
	option dest_port '53 80'
	option target 'ACCEPT'
	option dest '*'
	option family 'ipv4'
	list dest_ip '10.0.0.53'

config forwarding
	option src 'lan'
	option dest 'guests'

config forwarding
	option src 'guests'
	option dest 'wan'

I also tried to log the zones but logread is empty. Not sure why.

Thanks!

The following works for me:

Where I have wg you should substitute guests

Note that I have option forward ACCEPT
and I have also:

config forwarding
	option dest 'wg'
	option src 'lan'

My settings:

config zone
	option name 'wg'
	option input 'ACCEPT'
	option network 'WG_server'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config forwarding
	option dest 'lan'
	option src 'wg'

config forwarding
	option dest 'wg'
	option src 'lan'

# if you want to allow internet access from attached clients then allow to forward from WG to WAN
config forwarding
	option src 'wg'
	option dest 'wan'