What result do you get if you will ping the WG server from the WG client?
According to the Wireguard documentation, the WG server must have allowed ips from at least the internal WG subnet, i.e. in your case at least for your client allowed ips: 192.168.33.3/32
or as a proxy for all nodes allowed ips: 0.0.0.0/0,::/0