I found a better solution for my usecase. I just added a source requirement to all iptable rules. Since I have a static IP where my xen orchestra is hosted, this works perfectly for me.
# Generated by iptables-save v1.4.21 on Wed Nov 24 10:41:50 2021
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
:xapi-INPUT - [0:0]
-A INPUT -j xapi-INPUT
-A INPUT -p gre -j ACCEPT
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -s <redacted> -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -s <redacted> -i xenapi -p udp -m udp --dport 67 -j ACCEPT
-A RH-Firewall-1-INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -s <redacted> -p udp -m conntrack --ctstate NEW -m udp --dport 694 -j ACCEPT
-A RH-Firewall-1-INPUT -s <redacted> -p tcp -m conntrack --ctstate NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -s <redacted> -p tcp -m conntrack --ctstate NEW -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -s <redacted> -p tcp -m conntrack --ctstate NEW -m tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -s <redacted> -p tcp -m tcp --dport 21064 -j ACCEPT
-A RH-Firewall-1-INPUT -s <redacted> -p udp -m multiport --dports 5404,5405 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
-A xapi-INPUT -s <redacted> -p tcp -m conntrack --ctstate NEW -m tcp --dport 6653 -j ACCEPT
-A xapi-INPUT -s <redacted> -p tcp -m conntrack --ctstate NEW -m tcp --dport 6640 -j ACCEPT
-A xapi-INPUT -j RETURN
COMMIT
# Completed on Wed Nov 24 10:41:50 2021
I decided to do this after realizing that I am unable to access the XCP-ng management IP thought the WireGuard tunnel, because my request would leave the OPNsense wan port and be routed through the next Hetzner router before connecting with the management IP. This doesn’t work, because the source IP would be from a private IP range.