How to use hole punching(NAT traversal)?

[grantterra]

I have 3 nodes but only 1 have a static public IP address.

I noticed the NAT traversal listed on the “Features” page.(https://vpncloud.ddswd.de/features/)
but I didn't figure out how to use it.

I tried to set nodes that behind the NAT connects to the public one,
when it connected, both can ping the public one's virtual IP(Node 1, 10.76.76.10),
but they can't ping the other side.(Node 2 and Node 3).

Also, I'm using tap/switch mode, Node 2 and Node 3 layer 2 data has been sent to the node 1, but not going to the other side.

Maybe I'm misunderstood the manual, please correct me.

Here's my configurations:

Node 1 (Have a static public IP):

device:
  type: tap
mode: hub
ip: 10.76.76.10
ifup: >-
  sysctl -w net.ipv4.ip_forward=1
crypto:
  password: "passwd"

---

Node 2:

device:
  type: tap
peers:
  - node1publicip:3210
ip: 10.76.76.2
ifup: >-
  sysctl -w net.ipv4.ip_forward=1
crypto:
  password: "passwd"
keepalive: 2
peer-timeout: 6

---

Node 3:

device:
  type: tap
peers:
  - node1publicip:3210
ip: 10.76.76.3
ifup: >-
  sysctl -w net.ipv4.ip_forward=1
crypto:
  password: "passwd"
keepalive: 2
peer-timeout: 6

---