it is a known issue that is being worked on. if you turn off hole punching the DO node should be able to reach x or y provided that x or y initiate communications. For example, if x starts pinging the DO node, the DO node should be able to ping x. Until the issue is fixed, suggest you install netclient on either x or y but not both. Then make that node an egress gateway for the other. using the internal lan address with a /32 as the egress range