You could try turning on udp hole punching for the nodes behind the firewall. Alternatively, you could just use a single node behind the firewall and make that node an egress gateway