After installation of ifupdown2 and later reboot because of kernel upgrade, routing was messed up. This wasn't immediately noticed: default routing after interface activation with ifupdown goes through a wireguard connection. With ifupdown2, default routing was changed through bridged physical interfaces, while VPN devices could still be reached by their VPN IP Adresses.
An attempt to reload bridge interface (and, consequently, the wireguard VPN interface) resulted in no change to routing (means, still incorrect), but wireguard interface not obtaining an IP address any longer. Upping and Downing wireguard interface is done by up and down dependencies on bridge device in /etc/network/interfaces.
Returning to ifupdown fixed the matter.