wireguard client not connecting to the internet

For all its purpoted simplicity I am simply unable to setup wireguard such that a client can access the internet (WAN) through the wireguard VPN. I have googled for a couple of days and nothing has worked. I have my configuration here below, could anybody see what might be wrong?

• wireguard configuration on the server
• as you can see I have tried to set AllowedIPs to 0.0.0.0/0 as well to no avail. It looks though that with 0.0.0.0/0 a traceroute to facebook's IP (176.13.69.63) works but I cannot reach it otherwise.

    root@hattusa:~# cat /etc/wireguard/wg0.conf
    [Interface]
    PrivateKey = ***
    Address = 10.6.0.1/24
    ListenPort = 8765

    ### begin android ###
    [Peer]
    PublicKey = ***
    PresharedKey = ***
    #AllowedIPs = 0.0.0.0/0
    AllowedIPs = 10.6.0.2/32
    ### end android ###

• wireguard client configuration

    root@hattusa:~# cat /etc/wireguard/configs/android.conf
    [Interface]
    PrivateKey = ***
    Address = 10.6.0.2/24
    DNS = 8.8.8.8, 8.8.4.4

    [Peer]
    PublicKey = ***
    PresharedKey = ***
    Endpoint = ***:8765
    AllowedIPs = 0.0.0.0/0, ::0/0

• ipv4 forwarding is enabled

    root@hattusa:~# sysctl net.ipv4.ip_forward
    net.ipv4.ip_forward = 1

• I have tried different iptables rules, what I have added now is; I don't have a firewall running

    root@hattusa:~# iptables --list-rules
    -P INPUT ACCEPT
    -P FORWARD ACCEPT
    -P OUTPUT ACCEPT
    -A INPUT -i eth0 -p udp -m udp --dport 8765 -j ACCEPT
    -A INPUT -i wg0 -j ACCEPT
    -A FORWARD -i wg0 -o eth0 -j ACCEPT
    -A FORWARD -i eth0 -o wg0 -j ACCEPT

• I also have a masquerade rule but it doesn't show up. It is

    iptables -t nat -I POSTROUTING 1 -s 10.6.0.2/24 -o eth0 -j MASQUERADE

• the client can connect successfully, data is being sent and received and ping works from client as well (so DNS resolving is okay, but even if DNS is not working I should be able to reach hosts directly by IP)

    root@hattusa:~# wg
    interface: wg0
      public key: ***
      private key: (hidden)
      listening port: 8765

    peer: ***=
      preshared key: (hidden)
      endpoint: ***:31053
      allowed ips: 10.6.0.2/32
      latest handshake: 12 minutes, 32 seconds ago
      transfer: 1.32 MiB received, 2.13 MiB sent

• running debian buster on raspbian, port 8765 is open on the router both UDP and TCP (otherwise client won't be able to connect externally)