Can you help me understand the principle of routing in the connection diagram?

Question

Debian

There are 2 networks connected via Wireguard.
[192.168.11.0/24] <-...
...-> [router-192.168.11.1] <--> [192.168.11.3] [email protected]/[email protected]=== [192.168 .1.44] <--> [router-192.168.1.1] <-...
...-> [192.168.1.0/24]

192.168.11.3 and 192.168.1.44 are debian cars.

On 192.168.11.3, the rules are:
-A FORWARD -i wg0s -j ACCEPT
-A FORWARD -i wg0s -o br0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i br0 -o wg0s -m state - -state RELATED,ESTABLISHED -j ACCEPT
-A POSTROUTING -s 10.1.3.0/24 -o br0 -j SNAT --to-source 192.168.11.3

On 192.168.1.44 the rules are:
-A FORWARD -i wg0 -j ACCEPT
-A FORWARD -i wg0 -o enp4s0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i enp4s0 -o wg0 -m state - -state RELATED,ESTABLISHED -j ACCEPT
-A POSTROUTING -s 10.1.3.0/24 -o enp4s0 -j ​​MASQUERADE The funny thing

is that from 192.168.11.3 itself I can ping 192.168.1.72 (for example) and packets come there from IP wheelbarrows 192.168.1.44 (IP is substituted), and from the subnet behind it (192.168.11.0/24) packets are already going under their IPs (without being substituted).

Adding a rule to 192.168.1.44 solves the problem:
-A POSTROUTING -s 192.168.11.0/24 -o enp4s0 -j ​​MASQUERADE

Why is that? Is this how it should be or can it be done better?

Answer 1

As written, it works.
For example, here is the rule:
-A POSTROUTING -s 10.1.3.0/24 -o br0 -j SNAT --to-source 192.168.11.3
It should replace source for packets arriving from addresses 10.1.3.0/24 at the output to interface br0 . However, if we ping 192.168.1.72, the packets come back from 192.168.1.72 and are not replaced by 10.1.3.0/24 anywhere. And really, why change them?
The problem must be solved differently. You must either SNAT (MASQUERADE) to 192.168.1.44 from addresses not only 10.1.3.0/24, but also 192.168.11.0/24 (in this case, addresses 192.168.11.0/24 will go in the wg tunnel):
192.168.1.44:
-A POSTROUTING -s 10.1.3.0/24 -o enp4s0 -j ​​MASQUERADE
-A POSTROUTING -s 192.168.11.0/24 -o enp4s0 -j ​​MASQUERADE
Or you need to do a substitution on 192.168.11.3 with tunnel addresses, which in turn are replaced with a local IP already on the "that" side (in this case, only addresses 10.1.3.0/24 will go in the tunnel):
192.168.11.3:
-A POSTROUTING -o wg0 -j MASQUERADE
192.168.1.44:
-A POSTROUTING -s 10.1.3.0/24 -o enp4s0 -j ​​MASQUERADE