Scratch issue 7) above. It was because of issue 6) - once I disabled the netclient interface I could add an external client again which I tested and is working, but the full client can only connect to netmaker ip range as per 1)