How to use WireGuard with DigitalOcean Cloud Firewall

I recently deployed a droplet with WGDashboard so I could VPN into my private network and access other droplets. It seemed to work great until I decided to apply a cloud firewall to one of the droplets running a webserver. As soon as I applied the firewall I could no longer access that droplet over the VPN. Even if I allow all TCP and UDP connections it still does not work. If I remove the cloud firewall from the droplet access is restored. Is this expected behavior?

My end goal is to be able to restrict public vs private access. Example, being able to access Portainer over the VPN but not over the web.