ext clients are not normal peers .... they can only be reached through the ingress gateway. if you look at the peer section for the ingress gateway you will see the ip of extclients in the allowedips