I have another question though! I'm currently tinkering and have a Netmaker server running on a cloud VPS. Then I have 3 nodes. One of the nodes is from another VPS (digital ocean), and then the two (lets call them node x and y) remaning nodes are machines on my home network (behind NAT (opnsense)).
If node x and y is using UDP hole punching, the Digital Ocean node can access the other nodes just fine, and they can access the digital ocean node. But node x and y cannot access each other. But if I disable UDP hole punch on x and y (and they get the usual wireguard range ports) they can access each other, but then the digital ocean node cannot access them any longer (as expected as those ports aren't forwarded in opnsense).
What I can't figure out is why they can't access each other when using hole punch? wg show on x and y shows the peer to the other being the local ip with a randomized port, so they should be able to access each other directly?