I was under the impression that configuring and activating the WireGuard server on the router modified the firewall accordingly. I did not open the port manually before the reset (when the WireGuard configuration did work). Edit: Confirmed, there is a rule wgserver2lan. But for the wgserver interface, LuCi says “Unsupported protocol type.” After installing the missing bits of luci-proto-wireguard, this message is still there (but as I wrote in my original post, the WireGuard tunnel works from within the LAN).