so if you only run netclient on the host and not in the container, you can't do udp hole punching