separation of DNS requests from clients

[gryph-soul]

Hi.
On my server I use a wg-easy container and an adguard home container (as DNS).
The local addresses of the podman containers are:
wg-easy 10.20.1.5
adguard 10.20.1.2

All clients that connect to wireguard have addresses in the tunneled network range 10.50.1.0/24 and receive DNS 10.20.1.2 (it is accessible from the tunneled network 10.50.1.0).

On adguard itself I see incoming DNS requests only from the wg-easy 10.20.1.5 server, but I want to see requests from each client separately.

Inside the wg-easy container I see a NAT iptables rule that allows traffic between its eth0 interface and the 10.50.1.0 network.
If I delete this rule, then adguard starts seeing DNS requests from each client separately, but then the clients' internet doesn't work.

I tried to solve the problem using iptables rules inside the wg-easy container, but I got confused and couldn't.

Can you show me how to do this?

There is an example like PiHole + PiVpn where pihole sees a request from each client separately, but this solution is installed locally and not in containers, so it works there.