I am able to ping nodes behind CGNATs directly when using netclient agent. however the same doesnt work if I use netclose docker container. So looks like a configuration issue with docker netclient setup