I've now solved this issue for users with RT-BE86U using NAT PMP client / natpmpc to open up ports with ProtonVPN:
As suggested in other threads here I had an VPN Director exception for the router's IP to not go through the WireGuard tunnel:
from 192.168.50.1 lookup main
When running the NAT...
In the second table, when the RT-AX86U added the route for the VPN tunnel, I hadn't yet used VPN Director. That is, no rules were configured. I only added the WireGuard Client configuration and connected. That's it.
In the third and last table I had already added a VPN Director rule for the PC...
Alright! Since I still have the old one I did a factory reset of both them.
Both are running the latest Asuswrt-Merlin firmware (RT-AX86U: 3004.388.11 & RT-BE86U: 3006.102.7).
192.168.50.1 is the router
192.168.50.10 is the PC
10.2.0.1 is the WireGuard VPN tunnel
Noticed differences straight...
WAN > Enable UPnP is set to No (on both my old as well as my new router).
That's why I'm using natpmpc (NAT Port Mapping Protocol client) to open
up a port over the WireGuard tunnel like explained here:
https://protonvpn.com/support/port-forwarding-manual-setup#wireguard
Point is this works...
Trying to open up a port through the WireGuard VPN tunnel with this command:
natpmpc -g 10.2.1.1 -a 1 0 udp 60
Fails out of the box:
Thu Feb 26 15:03:04 CET 2026
initnatpmp() returned 0 (SUCCESS)
using gateway : 10.2.1.1
sendpublicaddressrequest returned 2 (SUCCESS)
readnatpmpresponseorretry...