OpenVPN trough Wireguard tunnel behind CGNAT router

[Labomba]

Hi Guys,
Can anyone help me figure out which settings I need to make the following work?
I have a 5G router behind a CGNAT provider, which means I can’t configure any open ports via NAT.
I then installed a PFsense behind this 5G router and set up a WireGuard tunnel, which works perfectly.
I can access an IP camera webpage via my VPS, which is connected to the PFsense behind the 5G router.
The WireGuard tunnel status is green.
However, I also want to set up an OpenVPN connection through that same tunnel, but I just can’t get the connection to establish.
Openvpn is configured and active on the WG0, Wireguard interface, same port 1194.
I’m using the default port 1194, and the OpenVPN is only active on the WireGuard tunnel.
I’ve also added a firewall rule allowing port 1194, and I’ve set it to NAT.
When logging in, OpenVPN asks for the password of the relevant user, but the TLS handshake fails with the error message:
TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
VPS port 1194 has been opened in iptables.

The pfSense setup is simple (no vlans):
WAN: CGNAT IP
LAN: 10.10.20.0
WG0: 10.50.50.100
OPENVPN: 10.10.100.0

I am convinced that a firewall rule is missing, but I cannot figure out which one, and information on this is scarce.
I know many people will suggest Tailscale, but I want to use this solution, and I know it can work.
Thanks in advance for your help!

[stephenw10]

In pfSense you should only need a rule on the Wireguard interface to allow port 1194 (presumably UDP).

You will need to forward the traffic in the VPS to pfSense over the tunnel though. Simply opening a port there would not be enough.

Check the state table and firewall logs in pfSense when you try to connect from a client. You should see states opened. You might see block logs if the rules in place don't match.