ok...i've got to go for now, but if the forwarding rule is there, iptables is set, and the private IP is reachable from the client + egress range in allowed ips, those are all the pieces necessary for it to work