Wireguard uses cryptokey routing as a basic concept:
https://www.wireguard.com/#cryptokey-routing
So the routing definition WHAT is passed into the tunnel is done with the “Allwed IPs” statement in the Peer definition or Wireguard. You are using 10.0.0.0 /24 as the internal WG network, which is btw. not very intelligent cause this IP is used by millions of users worldweide. A bit a more “exotic” network address would be better but anyway.
Having a local LAN segment this needs to be defined in a network notation under allowed IPs to pass this into the tunnel like:
AllowedIPs = 10.0.0.1/32, 192.168.0.0/24
If you have more segments they need to be added comma separated like:
AllowedIPs = 10.0.0.1/32, 192.168.0.0/24, 192.168.1.0/24
and so on.
You can also use a summary mask like:
AllowedIPs = 10.0.0.1/32, 192.168.0.0**/21**
Which then routes all IP nets from 192.168.0.0 to 192.168.7.0 into the tunnel.
This network declaration in your setup is missing ! Having only the internal 10.0.0.x/32 addresses here will allow ONLY a communication between server and clients but NO routing of the attached network segments !
A good explanation also here: http://forum.mikrotik.com/t/wireguard-allowed-ips-unofficial-wireguard-documentation/156426/1
Btw…
10.0.0.2 in your drawing is NOT a network address ! You should provide correct addresses here to not build any obstacles in understanding !