i think a combination of netmaker gateways in each network + https://projectcalico.docs.tigera.io/networking/vxlan-ipip#configure-vxlan-encapsulation-for-only-cross-subnet-traffic is my solution