Wireguard routing works fine site2site but issues with direct client connection

[soupdiver]

I have two pfSense boxes connected via a wireguard tunnel and everything works great.
Now I want to add another connection. A third client should join the network. That client should then be able to connect to machines behind the pfSense boxes.

On one of the boxes I have added another wireguard client.
The client can connect successfully. However there is some issue when trying to access machines in networks behind the pfSense boxes.

wg network: 10.250.0.0/16
ip machine a: 192.168.200.1
ip machine b: 10.240.0.2

machine a connects through wireguard and can access 10.240.0.1, which is the pfSense box but can not acces 10.240.0.2. From pfSense itself I can reach the .2
Interestingly a ping from 10.240.0.2 to 192.168.200.1 works just fine.

Trying to access 10.240.0.2 without a direct wg connection but transparently behind a pfSense box just works as expected.

Any ideas? Is there something different when it comes to routing and wireguard?