So finally I got Wireguard working in pfSense with a macOS and Android peer. It took quite some help from ChatGPT which explained the IPv6 addresses for the VPN, and helped get the various subnets right. The pfSense setup is fairly vanilla domestic setup, no special settings applied.
Here's the key details that pulled it over the line. The LAN is on 10.0.0.0/24 and the VPN subnet is 10.1.0.0/24.
The pfSense interface for Wireguard is set to have both static IPv4 and IPv6 addresses which are set to 10.1.0.1/24 and fd00:1:1:1::1/64 respectively. The MTU is set to 1420. Otherwise the settings in the pfSense Tunnel are straightforward.
The settings for the macOS peer in pfSense are dynamic peer is set, and the allowed IPs in the Peer configuration are 10.1.0.4/32 and fd00:1:1:1::4/128. The settings for the Android peer are similar, just replacing the 4 above with a 2. Again, the MTU is set to 1420.
The only firewall rule that seems to pass any traffic is Firewall / Rules / WireGuard
4824e018-b50b-4935-bc3d-50f6e7513696-image.png
There seems to be no need to put rules in the Wireguard interface firewall section. Similarly, there seems to be no need for any NAT settings, just leave on hybrid outbound NAT.
Then to the peer settings on the devices that connect to the VPN. The key settings are adequately documented in many other places, no need to repeat that but the IPv6 addresses are harder to find.
Wireguard on the macOS peer has this configuration -
[Interface]
PrivateKey = Ixxxyyyzzz2/GA3HDeE8GaoPZappqqqrrrEwrzLMHY=
Address = 10.1.0.4/24, fd00:1:1:1::4/128
DNS = 8.8.8.8, 10.0.0.1
MTU = 1420
[Peer]
PublicKey = vqverysecretkeylhiddenhereGQJHepd1zk=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = [2a00:6020:1000:33::1234]:51820
The Android peer is similarly set up, notable are the DNS settings, Endpoint and Allowed IPs. Of course it is helpful to completely stop any other VPN you may have installed such as HMA, and in the VPN settings make sure that Always-on VPN is switched off, as this will block Wireguard.
Please let me know if any of this is incorrect, but otherwise This Works For Me (tm) and hope it helps someone.