Block all external traffic except for LAN and Wireguard VPN?

[dkshaw]

I'm working to set up a situation in pfsense and HAProxy where I can access internal services with a FQDN ONLY when on my network. I have everything set up thus far and working well, but now I want to see if I can also view those internal services when I am on VPN (Wireguard) outside of my network.

For my shared front end my ACL is looking for source IP's that are an alias of my internal network IP's (192.168.1.x). For Wireguard I have a different subnet (10.10.10.x). I thought that if I were to add the Wireguard IP's to the alias that it would work, but it doesn't. I'm guessing that HAProxy doesn't see a Wireguard peer (my phone) source IP as being the 10.10.10.x, but instead it is my Verizon public IP?

Is there a way that I can identify Wireguard peers connected to the network somehow and allow that traffic to access the backends that I have? Interface assignment? MAC address?