Just to verify what I think is now happening: Are external clients now fully routed and not NATed behind the "entry point"?