Wireguard - Clients can ping server but not each other

Question

I have 3 nodes - 1 server, and two additional clients.

I can successfully ping the server endpoint from both clients, and I can ping the two clients from the server. However the two clients can not ping each other successfully.

I'm not too sure if I've sent the endpoint correctly - I can't find much information about what this should be set to.

On the server I see a debug error log of:

[ 2848.826167] wireguard: wg0: Invalid MAC of handshake, dropping packet from 90.218.41.186:1024

Where might I be going wrong?

---

  peers = [
    # For a client configuration, one peer entry for the server will suffice.

    # server
    {
      publicKey = "***************";
      allowedIPs = [ "10.100.0.1"];
      endpoint = "**Server_IP_redacted**:51820"; 
      persistentKeepalive = 25;
    }

    # pineapple
    {
      publicKey = "*************";
      allowedIPs = [ "10.100.0.2" ];
      endpoint = "**Server_IP_redacted**:51820"; 
      persistentKeepalive = 25;
    }
  ];

Answer 1

It started working correctly after having a single peer defined for the server and setting the appropriate subnet instead for the allowedIps instead of an explicit IP.

peers = [

        # server
        {
          publicKey = "**********";
          allowedIPs = [ "10.100.0.0/24"];
          endpoint = "**Server_IP_redacted**:51820"; 
          persistentKeepalive = 25;
        }

  ];

I think I also needed to enable NAT on the server with:

  networking.nat.enable = true;