Netmaker + GL-B2200 Mesh unable to ping local devices

I am using netmaker as a wireguard management service. I have set it up with the following:

  • netmaker server on a vps (
  • a host as ingress on the vps (
  • a host as egress on my gl-b2200 home router. ( the home router is also my primary gateway for my lan

the egress configuration is setup with a CIDR with NAT for egress traffic enabled. some things i have confirmed working so far:

  • from the vps i can successfully ping
  • from the vps i can successfully ping
  • from the home router i can successfully ping
  • from the home router i can successfully ping

but, from the vps i cannot ping

# from the vps ping some other device on my lan
From icmp_seq=1 Destination Port Unreachable

i think i have confirmed that ip forwarding is enabled on the openwrt router:

# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

and it seems that both network interfaces are up

ifconfig br-lan

br-lan    Link encap:Ethernet  HWaddr my:mac:addr  
          inet addr:  Bcast:  Mask:
          RX packets:xx errors:0 dropped:29 overruns:0 frame:0
          TX packets:xx errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:xx (xx.x GiB)  TX bytes:xx (xx.x GiB)

ifconfig netmaker

netmaker  Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:  P-t-P:  Mask:
          UP POINTOPOINT RUNNING NOARP  MTU:1420  Metric:1
          RX packets:xx errors:0 dropped:7 overruns:0 frame:0
          TX packets:xx errors:0 dropped:1 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:xx(x.x KiB)  TX bytes:xx (x.x KiB)

the networking world is somewhat new to me. i would guess there is something in the firewall / iptables that is dropping this but i dont really know how to debug further and am looking for some guidance. Thanks!

i went back and confirmed this also works on the glinet firmware.

uci add_list firewall.@zone[0].device='netmaker'
uci commit firewall
fw3 restart