hole punching fails

[fireapp]

one lighthouse ip : 192.168.111.1
two local nodes are behind a difficult nat, ip : 192.168.111.2 and 192.168.111.4
two local nodes can not connect each other

here is node 192.168.111.2 logs

 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="219.142.145.143:33902" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="219.142.145.143:33902" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="219.142.145.143:33902" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="219.142.145.143:33902" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="219.142.145.143:33902" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="192.168.1.13:46888" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="192.168.122.1:46888" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="172.17.0.1:46888" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="219.142.145.143:33902" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="192.168.1.13:46888" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="192.168.122.1:46888" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="172.17.0.1:46888" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="219.142.145.143:33902" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="192.168.1.13:46888" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="192.168.122.1:46888" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="172.17.0.1:46888" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="219.142.145.143:33902" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="192.168.1.13:46888" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="192.168.122.1:46888" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="172.17.0.1:46888" vpnIp=192.168.111.4

[rawdigits]

Are 192.168.111.2 and 192.168.111.4 on the same local network? It seems surprising that the local packets are also failing, if so. IE:

 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="192.168.1.13:46888" vpnIp=192.168.111.4
 level=info msg="Handshake message sent" handshake="map[stage:1 style:ix_psk0]" initiatorIndex=1352070048 remoteIndex=0 udpAddr="192.168.122.1:46888" vpnIp=192.168.111.4

which appears to show handshake attempts to 192.168.1.13 and 192.168.122.1. (I'm guessing 192.168.122.1 indicates libvirt is in use?)

[fireapp]

yes, 192.168.122.1 is interface virbr0

nodes 192.168.111.2 and 192.168.111.4 are on different routers, but has same ip segment 192.168.1.1/24
When I restarted many times nebula, it can work ok

[jocull]

Not out to necro this issue too much, but I also tried to set this up with a public lighthouse and a single node behind NAT tonight. I was unable to ping the lighthouse until I opened a node firewall port for 4242, even with reverse punching enabled. Wasn’t able to determine exactly why, but just wanted to mention it

[admun]

I seem to be seeing a similar issue. One lighthouse in digital ocean, and a node behind NAT at home. ping seems to be sent to lighthouse, inbound/outbound ACL set to all tcp/udp, yet ping blackhole'd.