RT-AX86U Pro: WireGuard handshakes work but no traffic passes on Merlin 3006.102.8

After updating my ASUS RT-AX86U Pro from Asuswrt-Merlin 3006.102.7_2 to 3006.102.8, all my WireGuard connections stopped passing traffic.

The peers still completed handshakes normally, and the WireGuard interface was up:

wgs1: <POINTOPOINT,NOARP,UP,LOWER_UP>
inet 10.6.0.1/32

However, I could not ping the router, access the LAN, or use my site-to-site tunnel.

Immediately after reboot on 3006.102.8:

cat /proc/sys/net/ipv4/ip_forward

returned:

0

The WireGuard firewall hooks were also missing:

iptables-save | grep -E '^-A (INPUT|FORWARD) -j WGS[IF]|^-A WGS[IF].*wgs1'

returned nothing.

Running the following restored connectivity immediately:

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -I INPUT 1 -i wgs1 -j ACCEPT
iptables -I FORWARD 1 -i wgs1 -j ACCEPT
iptables -I FORWARD 1 -o wgs1 -j ACCEPT

After rebooting, the problem returned.

I then downgraded to 3006.102.7_2 without changing the configuration, and WireGuard started working normally again after reboot.

My setup:

• RT-AX86U Pro
• Wireless Router mode
• WAN port unused
• Router located behind another primary router
• DHCP disabled
• WireGuard server used for remote clients and a site-to-site tunnel

This does not appear to be a WireGuard handshake problem. It looks like a regression in 3006.102.8 where IPv4 forwarding and the WireGuard firewall rules are not initialized correctly during boot.

Has anyone else seen this on 3006.102.8?