but the clients in the "external" network can't reach hosts in the mesh, as it's NAT-ing the traffc the other way if I'm not mistaken