the port forwarding seems to be required for external nodes with public IPs to reach internal nodes it seems