diff --git a/modules/server/nftables/default.nix b/modules/server/nftables/default.nix
index 6783406..0631ef7 100644
--- a/modules/server/nftables/default.nix
+++ b/modules/server/nftables/default.nix
@@ -1,6 +1,9 @@
 { config, lib, ... }:
 let
  cfg = config.syscfg.server;
+ wg = cfg.wireguard && config.syscfg.net.wg.enable;
+ wgIp4 = builtins.head (lib.splitString "/" config.syscfg.net.wg.ip4);
+ wgIp6 = builtins.head (lib.splitString "/" config.syscfg.net.wg.ip6);
 in {
   config = lib.mkIf (cfg.ipfw.enable) {
     boot.kernel.sysctl = {
@@ -27,6 +30,11 @@ in {
 
                 iifname "${srcInt}" tcp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
                 iifname "${srcInt}" udp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
+            '' + lib.optionalString wg ''
+                iifname "wg0" fib daddr type local ip daddr != ${wgIp4} tcp dport ${srcPort} counter dnat ip to ${dstAddr4}:${dstPort}
+                iifname "wg0" fib daddr type local ip daddr != ${wgIp4} udp dport ${srcPort} counter dnat ip to ${dstAddr4}:${dstPort}
+                iifname "wg0" fib daddr type local ip6 daddr != ${wgIp6} tcp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
+                iifname "wg0" fib daddr type local ip6 daddr != ${wgIp6} udp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
             ''
           ) cfg.ipfw.ports}
         }