$ sudo sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

is as expected on the linux client egress

if I use the netmaker server as ingress and egress, it also works

$ nft list ruleset
table ip filter {
    chain forward {
        ct state established,related accept
        iifname "nm-skynet" accept
        oifname "nm-skynet" accept
    }
}
table ip nat {
    chain prerouting {
        type nat hook prerouting priority filter; policy accept;
    }

    chain postrouting {
        type nat hook postrouting priority filter; policy accept;
        oifname "enp0s5" counter packets 169 bytes 11515 masquerade
    }
}

the nft ruleset on egress client

hm, according to docs, this should definitely work: https://netmaker.readthedocs.io/en/master/egress-gateway.html, appears to be a bug at this point

I tried with two netclient clients (Linux and Windows VMs), but they couldn't reach each other due to hard NAT. So I used my netmaker server to relay one of the clients, then both of the clients, but this did not work either. In fact, every time I relayed either client, the web ui graph completely disconnected that client node (circle) from the rest. is egress completely broken?

I updated my description above with some more info on the clients

I mark my server, netmaker-1, as a relay for Windows. Then this happens:

I think this is just a graphical glitch though, I can still ping Ubuntu from Windows even though it's routed via netmaker-1 as confirmed by "wg" command.

Now the problem is if we turn Ubuntu to an egress:

Whether relayed or not, it does not see any traffic, as confirmed by "wg" command on Windows:

powershell
PS C:\Users\user> wg
interface: nm-wg-vnet
  public key: xxx
  private key: (hidden)
  listening port: 59903

peer: xxx
  endpoint: xxx:51821
  allowed ips: 10.146.92.254/32
  latest handshake: 18 seconds ago
  transfer: 92 B received, 180 B sent
  persistent keepalive: every 20 seconds

peer: xxx
  endpoint: 10.211.55.4:58920
  allowed ips: 0.0.0.0/0, 10.146.92.1/32
  transfer: 0 B received, 592 B sent
  persistent keepalive: every 20 seconds

PS C:\Users\user> ping google.com

Pinging google.com [142.250.200.46] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 142.250.200.46:
    Packets: Sent = 3, Received = 0, Lost = 3 (100% loss)

PS C:\Users\user> ping 10.146.92.1

Pinging 10.146.92.1 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 10.146.92.1:
    Packets: Sent = 3, Received = 0, Lost = 3 (100% loss)

Bear in mind that my VMs are connected between themselves over 10.211.55.0/24, this is how netmaker made the direct connection.

My full system (host + VMs) has IPv6 connectivity too, if that makes a difference. I disabled IPv6 on my Windows via adapter properties > untick ipv6, and Ubuntu via

sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1

, and now the two can't ping each other, even after leaving and rejoining the netmaker network on both.

So to summarize, 3 issues above, 1 of which likely just graphical, 2 of which critical

In my second experiment, I didn't even use an external client, I used two netclient clients, and like you mentioned with the external client, as soon as I set one as egress with 0.0.0.0/0, they stopped being able to ping, so I think this is a general routing issue with internet egress

thanks for reporting these @lively-salesclerk-37295