wireguard 'road warrior' cannot use my dns

[dbjungle]

/interface wireguard peers add allowed-address=192.0.2.241/32
/ip firewall filter add action=accept chain=input comment=“allow Wireguard traffic” src-address=192.0.2.240/28

The incoming wireguard user (assuming thats you the ADMIN) to access DNS must have access on the input chain which the above rule provides. Its really designed to allow ADMIN to configure router remotely.
For other wireguard users that are not ADMIN but may be coming into the router but should not have OPEN access to the router would not be on the above rule but would be covered by adding the wireguard1 interface to the LAN list and thus your rule below would permit DNS.
/ip firewall filter add action=drop chain=input comment=“defconf: drop all not coming from LAN” in-interface-list=!LAN

Adding my wireguard interface to the LAN list resolved the DNS access issue for me, however it doesn’t work with just the input chain firewall rule for my wireguard subnet. My wireguard server subnet is 192.168.222.0/24, the client has 192.168.222.1 (router wireguard interface IP) for DNS and my firewall filter rule is as below:
/ip firewall filter add action=accept chain=input comment=“vpn server” src-address-list=192.168.222.0/24

Shouldn’t this still work without adding the wireguard interface to the LAN list because the firewall rule is accepting traffic from the source subnet without any restriction on ports or destination address?

In addition, which is preferrable for security implications? I only have the defconf drop all not coming from LAN rule using the LAN list at the moment.