SSH stuck

[Bzzzz]

Debian jessie + backports - arch amd64
Kernel 4.9.18-1~bpo8+1
wireguard-dkms  0.0.20170421-wg1~zesty
wireguard-tools 0.0.20170421-wg1~zesty
======================================
Hi list,

Setup:
LAN: 192.168.1.0/24
VPN: 10.11.12.0/24 (SRV: …1, CLI: …2)
(Client: AllowedIPs=0.0.0.0/0)

1- I solved the LAN being unreachable apart the endpoint and the internet
   being completely unreachable with an iptables rule:
   iptables -t nat -I POSTROUTING -s 10.11.12.0/24 -o eth0 -j MASQUERADE
   is this right? (if not, why?)

2- When I want to ssh any LAN machine, wireshark only sees 4 packets:
	client announce
	server ACK
	client key negociation
	server key negociation
   and that's all.
   Is it a limitation (non-TCP packets) or is there another reason for
   ssh not working as expected? (connecting to any machine http srv works
   perfectly)

Jean-Yves