As a quick workaround I set up a single instance of dockerized Wireguard at potato-0 routing all traffic through itself. From it netmaker subnet is visible as well as external server from potato-0 ip address