For what it's worth, the RELATED, ESTABLISHED rule in FORWARD is a bad thing to forget; I was getting all sorts of interesting ICMP timeout errors because I didn't have it.
New connections from clients were allowed, but I didn't have a rule to allow related and established, which made some things work, but mostly not.
I followed the installation instructions at https://www.wireguard.com/install/
For VPN setup, the Arch Wiki is a great reference: https://wiki.archlinux.org/index.php/WireGuard#Specific_use-...
I also set up Unbound + Stubby with DNS-over-TLS.
For what it's worth, the RELATED, ESTABLISHED rule in FORWARD is a bad thing to forget; I was getting all sorts of interesting ICMP timeout errors because I didn't have it. New connections from clients were allowed, but I didn't have a rule to allow related and established, which made some things work, but mostly not.