yes UDP hole punching and Default ACL. ipv4 only. Machines are behind NAT, also one client on 4G hotspot for tests. port forwarding done for netmaker server.