diff --git a/VERSION b/VERSION
index da44c7f..3baec79 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.1.50
+1.1.51
diff --git a/internal/firewall/firewall.go b/internal/firewall/firewall.go
index b3005b8..0969043 100644
--- a/internal/firewall/firewall.go
+++ b/internal/firewall/firewall.go
@@ -103,6 +103,14 @@ type View struct {
 	// Operator never edits these — they belong to the service. If
 	// the service is removed/disabled, the rule is gone next render.
 	AutoRules []AutoFWRule
+
+	// WGServerIfaces holds the interface names of all active
+	// WireGuard server-mode interfaces. The forward chain emits
+	// iifname "<iface>" accept for each — required so that peer-to-
+	// peer traffic (Peer A → Peer B both connected to the same wg
+	// interface) can be forwarded by the box. Without this, the
+	// forward policy=drop silently kills all inter-peer packets.
+	WGServerIfaces []string
 }
 
 // AutoFWRule is one auto-emitted inbound rule. Proto is "tcp" or
@@ -278,6 +286,19 @@ func (g *Generator) loadView(ctx context.Context) (*View, error) {
 	// ── Auto-Rules aus laufender Service-Config ──
 	view.AutoRules = g.loadAutoRules(ctx)
 
+	// ── WireGuard server-iface names (für forward-chain) ──
+	wgRows, err := g.Pool.Query(ctx,
+		`SELECT name FROM wireguard_interfaces WHERE active AND mode = 'server'`)
+	if err == nil {
+		defer wgRows.Close()
+		for wgRows.Next() {
+			var name string
+			if wgRows.Scan(&name) == nil {
+				view.WGServerIfaces = append(view.WGServerIfaces, name)
+			}
+		}
+	}
+
 	return view, nil
 }
 
diff --git a/internal/firewall/ruleset.nft.tpl b/internal/firewall/ruleset.nft.tpl
index 941d2be..4d35bb8 100644
--- a/internal/firewall/ruleset.nft.tpl
+++ b/internal/firewall/ruleset.nft.tpl
@@ -98,6 +98,15 @@ table inet edgeguard {
         ip saddr {{.SrcCIDR}} ct state new accept comment "auto-forward for NAT rule {{.ID}}"
 {{end}}{{end}}{{end}}
 
+        # Auto-Forward für WireGuard-Server-Interfaces: Peer-to-Peer-
+        # Traffic (Peer A → Peer B, beide via dasselbe wg-Interface)
+        # muss durch die Box forwarded werden. Ohne diese Regel droppt
+        # policy=drop den Traffic, auch wenn WG ihn korrekt entschlüsselt.
+        # Return-Pakete gehen bereits via ct state established durch.
+{{range .WGServerIfaces}}
+        iifname "{{.}}" accept comment "auto: WireGuard peer-forward {{.}}"
+{{end}}
+
         # Default-Drop-Logging (limit-rated, siehe input-chain).
         limit rate 10/second log prefix "edgeguard:drop-forward " group 0
     }