think there still might be a bug where ext clients don't get egress ranges.... not sure