you need one ingress gateway for the laptop/phone/tablet to connect to as ext clients and two egress gateways (10.100.100.0.24 and 192.168.3.0/24) for access to the internal networks