That could indeed happen if unbound would be receiving requests with a source IP that doesn't match its configured interface.
In turn, that would suggest that ntftables would source-NAT requests from the loopback interface.
The remedy would then be to apply srcnat masquerading to just those inbound and outbound interfaces that involve wireguard (which was always the case with iptables).
Of course, wireguard's interface would be the inbound one, and judging by your debug logs, your outbound interface would be eth0 for both nickclyde and @Blockhead.
Please try the following (while at home, connected directly to your home network):
a. bring down your Wireguard interface:
sudo wg-quick down wg0
b. change your Wireguard's PostUp rules:
sudo nano /etc/wireguard.conf
by replacing your PostUp with the folllowing rules:
PostUp = nft add table ip wireguard; nft add chain ip wireguard wireguard_nat {type nat hook postrouting priority srcnat\; policy accept\;}; nft add rule ip wireguard wireguard_nat iifname %i oifname 'eth0' counter masquerade
PostUp = nft add table ip6 wireguard; nft add chain ip6 wireguard wireguard_nat {type nat hook postrouting priority srcnat\; policy accept\;}; nft add rule ip6 wireguard wireguard_nat iifname %i oifname 'eth0' counter masquerade
You'll note that I've separated the tables for IPv4 and IPv6 into their own PostUp lines.
c. bring Wireguard up again:
sudo wg-quick up wg0
d. verify both tables have been created
sudo nft list table ip wireguard; sudo nft list table ip6 wireguard
Output should look similar to (click for details)
table ip wireguard {
chain wireguard_chain {
type nat hook postrouting priority srcnat; policy accept;
iifname "wg0" oifname "eth0" counter packets 0 bytes 0 masquerade
}
}
table ip6 wireguard {
chain wireguard_chain {
type nat hook postrouting priority srcnat; policy accept;
iifname "wg0" oifname "eth0" counter packets 0 bytes 0 masquerade
}
}
In particular, verify that %i has been correctly replaced by your wireguard's interface name.
e. run a few test lookups to your different IP ranges:
-- to your local unbound
dig -p 5335 @127.0.0.1 pi-hole.net
-- to your Pi-hole's home network IP address
dig @<pi.ho.le.ip> pi-hole.net
-- to your Pi-hole's wireguard IP address
dig @<wg.pi.ho.le> pi-hole.net
If that doesn't work straight away, please consider a reboot, and report back whether that would allow Pi-hole/unbound/Wireguard to work for you without expanding unbound's access-control.