I want to be able to have my WireGuard client in one subnet and have it access remote devices in the same and another subnet. By changing the address of the client I can access devices in either subnet but not both at the same time. I can ping any device from the CHR in either subnet: 172.16.254.0/23, 172.16.100.0/23 so the WireGuard VPN from the CHR to the remote devices works. Also, I can access the CHR from the client over WireGuard from either address listed below regardless of which subnet the client is on. Do I need firewall rule(s) to forward packets between subnets?

I hope I've explained this well enough. Thanks.

Client config:

[Interface]
PrivateKey = XXXX
Address = 172.16.100.3/32
DNS = 8.8.8.8

[Peer]
PublicKey = XXXXX
AllowedIPs = 172.16.0.0/16
Endpoint = x.x.x.x:13231
PersistentKeepalive = 20

Cloud Hosted Router Config:

allowed-address=172.16.100.3/32 comment="Laptop" interface=wg-to-endpoints public-key="***********"

address=172.16.254.1/23 interface=wg-to-endpoints network=172.16.254.0
address=172.16.100.1/23 interface=wg-to-endpoints network=172.16.100.0