Hmm do a traceroute and see where it’s dying. Can you ping inside IP of the tunnel on the wireguard server? What about outside?
What did you deploy in docker, firezone or basic wireguard?
Does your phone say connected and you see both incoming and outgoing packets? Is there a firewall in place on the wireguard host (ufw maybe)?
If you have nmap available you can also check port status.
You can bound ufw rules to interfaces, so you can allow in only on the wg0 interface and not eth0 interface.
Glad it’s working! I love wireguard!