Publishing a remote WireGuard endpoint through pfSense WAN IP

[enicolau]

I’m trying to make a device on the remote side of a WireGuard VPN (point B) accessible from the Internet using pfSense’s public IP.

pfSense has a public IP on WAN and a WireGuard tunnel to a MikroTik behind NAT.

The tunnel works perfectly — I can reach all devices on the remote network (e.g., 172.16.10.1, 172.16.10.2).

I want to expose the MikroTik’s web service (port 80) via pfSense’s public IP, for example:
incoming WAN:8080 → 172.16.10.2:80 (through WireGuard).

The problem:

The port forward works if the target is a LAN IP.

It fails when the target is an IP inside the WireGuard tunnel.

Routes are configured, the WireGuard interface is assigned, and outbound NAT and firewall rules are correct.
Still, pfSense doesn’t apply the NAT redirect to the WireGuard interface.

Why does pfSense skip NAT when forwarding to a WireGuard peer, and what’s the correct way to make a remote WireGuard host publicly accessible through pfSense?

Looking for a technical explanation and possible workarounds (loopback alias, double NAT, pf rules, etc.).