@zsdc - Thank you for cleaning up my config posting. I figured out how you did it and that has changed my life on this forum 
I actually got my setup half working last night .
I had to change my table configuration so it now looks like this.
protocols {
static {
interface-route 10.0.51.0/24 {
next-hop-interface wg01 {
}
}
interface-route 10.0.53.0/24 {
next-hop-interface wg01 {
}
}
interface-route 192.168.75.0/24 {
next-hop-interface wg01 {
}
}
interface-route 192.168.80.0/24 {
next-hop-interface wg01 {
}
}
table 100 {
interface-route 0.0.0.0/0 {
next-hop-interface wg01 {
}
}
}
}
}
So now my 192.168.3.0/24 network is now routing traffic over my VPN and reports back the public IP of the CloudVyOS VM when I hit up whatsmyip or ipchicken.
Now for the fun part… I cannot seem to get traffic to route back when trying to establish new connections by hitting my Public IP in the CloudVyOS instance.
So far I have tried just adjusting my WAN_IN firewall rules and setting up a destination nat in my CloudVyOS but I do not get successful connections back on the ports that open up. I also have no policy based routing created in the CloudVyOS instance. Only HomeVyOS has that PBR in the config as shared earlier.
Here is the example of the rules I created on CloudVyOS to open ports.
name WAN_IN {
default-action drop
description "Wan to Internal"
rule 20 {
action accept
description "Allow established/related"
log disable
protocol all
state {
established enable
invalid disable
new disable
related enable
}
}
rule 30 {
action drop
description "Drop invalid state"
log disable
protocol all
state {
established disable
invalid enable
new disable
related disable
}
}
rule 40 {
action accept
destination {
address 192.168.3.100
port 7777,27015
}
protocol tcp_udp
state {
new enable
}
}
rule 50 {
action accept
description "Conan Exile Server"
destination {
address 192.168.3.101
port 7778,7779,27016
}
protocol tcp_udp
state {
new enable
}
}
}
nat {
destination {
rule 10 {
description "TCP/UDP to 192.168.3.50 for Ark Server 7777"
destination {
port 7777,27015
}
inbound-interface eth0
protocol tcp_udp
translation {
address 192.168.3.100
}
}
rule 30 {
description "TCP/UDP to 192.168.3.101 for Conan Exiles Server 7778"
destination {
port 7778,7779,27016
}
inbound-interface eth0
protocol tcp_udp
translation {
address 192.168.3.101
}
}
}
source {
rule 5000 {
outbound-interface eth0
protocol all
translation {
address masquerade
}
}
}
}
@hagbard - I think you are looking for this. CLIENT3 is my primary VPN connection and is where most of my network is found so I set the allowed ip to everything.
CloudVyOS
wireguard wg01 {
address 10.0.51.1/24
description "Wireguard VPN Server"
peer CLIENT2 {
allowed-ips 192.168.80.0/24
allowed-ips 10.0.53.0/24
persistent-keepalive 15
pubkey ****************
}
peer CLIENT3 {
allowed-ips 0.0.0.0/0
persistent-keepalive 15
pubkey ****************
}
port 51820
}
}
HomeVyOS (Server address removed as to not expose my public IP for obvious reasons)
wireguard wg01 {
address 10.0.54.1/24
description "Wireguard VPN Server"
firewall {
in {
name Wireguard_Network
}
local {
name Wireguard_Network
}
}
peer SERVER {
allowed-ips 0.0.0.0/0
endpoint ***************
persistent-keepalive 15
pubkey ****************
}
port 51820
}
}
Just to add here is the firewall rule that is attached to my Wireguard interface on HomeVyOS
name Wireguard_Network {
default-action accept
rule 10 {
action drop
description "Block Management Access"
destination {
address 192.168.100.0/24
}
}
rule 11 {
action drop
description "Block ISCSI Access"
destination {
address 10.0.1.0/24
}
}
rule 13 {
action drop
description "Block Guest Network Access"
destination {
address 192.168.2.0/24
}
}
}
And here is the firewall rule on my hosted network interface
name Hosted_Network {
default-action accept
rule 10 {
action drop
description "Block Management Access"
destination {
address 192.168.100.0/24
}
}
rule 11 {
action drop
description "Block Internal Lan Access"
destination {
address 192.168.1.0/24
}
}
rule 12 {
action drop
description "Block ISCSI Access"
destination {
address 10.0.1.0/24
}
}
rule 13 {
action drop
description "Block Guest Network Access"
destination {
address 192.168.2.0/24
}
}
}