Also, port forwarding does not work for the router's VPN client IP - I expected that setting 'NAT Enabled = YES' will assign the wireguard client interface to the same firewall zone as WAN.

nmap scan of the router's wireguard client IP address - scan executed from the wireguard server where the router's wireguard client was connected to: # nmap -Av 192.168.100.100 ... Scanning...

Hi, I configured wireguard vpn client on TP-Link Archer AX23 V2 running firmware 1.1.2 Build 20250814 rel.14122(4555) and discovered the following security problems: 1. router's LAN is not protected...