Example scenario for an IPv4 only case:
3 VyOS machines are being connected together in a star-topology manner, called VyOS1, VyOS2 and VyOS3, so that VyOS2 lies in between the two others which do not have a direct tunnel connection to eachother.
For simplicity, static routes are being used to enable traffic exchange between clients behind VyOS1 and VyOS3 for source and destination IP ranges, as well as the wireguard tunnel ranges.
So the traffic is being sent in the following manner, e.g. using an ICMP command:
[Client]<-LAN->[VyOS1]<-wg->[VyOS2]<-wg->[VyOS3]<-LAN->[Client]
This works flawlessly in both directions when using NAT with any given WAN interface on VyOS1 and VyOS3.
It does not work when using a wan load balance configuration on VyOS1 and VyOS3 (not tested if problem occurs when only one of those two use a load balancer)
What does work:
[VyOS1]<-wg->[VyOS2]<-wg->[VyOS3]
and one-way: [VyOS1]<-wg->[VyOS2]<-wg->[VyOS3]<-LAN->[Client]
or [Client]<-LAN->[VyOS1]<-wg->[VyOS2]<-wg->[VyOS3]
when initiating the traffic from a VyOS router but NOT from a client.
It seems that the dynamic NAT Table used from the WAN load balancer does not apply the proper routing when tunneling into WireGuard tunnels.
Using
set load-balancing wan sticky-connections inbound
and
set load-balancing wan rule <rulenumber> failover
does not help.