Oh, I am sorry. I missed to say that "mobil-gehirn" is an external wireguard client (iPhone). There is no issue opening the ports using netmaker-1. It can reach dns and ssh on intern-pihole.