need nat punchtrough before using external ip