When connecting to a WireGuard VPN using NetworkManager on RHEL/CentOS systems, the connection succeeds but there is zero internet or network connectivity (pings fail). Meanwhile, OpenVPN works perfectly fine.
Unlike OpenVPN, which adds standard routes to your main routing table, NetworkManager's WireGuard implementation uses Policy-Based Routing (PBR) and firewall marks (fwmark) to route traffic through a hidden routing table (usually table 51963).
RHEL and CentOS enforce Strict Reverse Path Filtering (rp_filter=1) by default for security. The kernel's anti-spoofing mechanism sees incoming return packets on your physical interface, checks the main routing table, gets confused by the fwmark setup, and drops the packets.
You need to tell the kernel's Reverse Path Filter to take routing marks into account by enabling src_valid_mark.