I think I could solve this, after some more fiddling.

I tried this again once I was home and could check from both sides more easily.

TL;DR Damn you, providers handing our DNS answers even if they are not existing...

Long story:

The client's connection request went via IPv6, as apparently it got a valid AAAA DNS answer, even though the Wireguard server's hostname only has an A record in the authoritative DNS server. Seems like some provider inbetween messed with this or did the "not found, here is a page full of ads..." thingy.

After restricting the client to only use IPv4, everything was fine. Pings worked from both client and server, networks behind the server were reachable.

#Wireguard #Linux #VPN #HomeLab #SelfHosting #Debugging #Network #AdminLife #HellYeah