firewall / port forward - ?

[lejeczek]

Hi guys.

I'm still new to wireguard and still not an expert on network stack so I 
struggle with something what might be trivial.

A roadwarrior when connected to the server sees a forward-port on 
server's internal network as 'closed':

10.3.9.10 -> 10.3.9.1 <server> 10.3.1.1 (port forward) => 10.8.9.1 (a 
dummy iface, still server)

but rest of 10.3.1.0/24 sees that forwarded port - as I expected - as 'open'

If that same server port is not forwarded ("stays" on 10.3.1.1) then 
that roadwarrior sees the port as 'open'

I've fiddled with firewall all I could so I think it's not in there - 
thus hoping expert(s) can help me wrap my head around it.

many thanks, L.