[relayed] and [direct] for devices in same private network (NAT0).

My Network:
internet(public ip) -> routerA -> routerB (dmz, zt01) -> {windows(zt02), linux(zt03), linux(dmz, zt04 with nftables)}

The router has enabled upnp and DMZ(zt04 device).
The zt04 has nft ruleset like

table inet filter {
	chain input {
		type filter hook input priority filter; policy drop;
		ct state invalid drop comment "early drop of invalid connections"
		ct state { established, related } accept comment "allow tracked connections"
		iifname "lo" accept comment "allow from loopback"
		ip protocol icmp accept comment "allow icmp"
		meta l4proto ipv6-icmp accept comment "allow icmp v6"
		tcp dport 22 accept comment "allow sshd"
		udp dport 9993 counter packets 2 bytes 324 accept
		meta pkttype host limit rate 5/second counter packets 1008 bytes 85563 reject with icmpx admin-prohibited
		counter packets 360 bytes 23440
	}
}

{
 "address": "<id>",
 "clock": 1693276197375,
 "config": {
  "settings": {
   "allowTcpFallbackRelay": true,
   "forceTcpRelay": false,
   "listeningOn": [
    "172.17.0.1/25109",           # zt01 
    "<private ipv4>/25109", 
    "172.17.0.1/22555",           # zt01
    "<private ipv4>/22555", 
    "<public ipv6>/9993",
    "<public ipv6>/25109",
    "<public ipv6>/22555"
   ],
   "portMappingEnabled": true,
   "primaryPort": 9993,
   "secondaryPort": 25109,
   "softwareUpdate": "disable",
   "softwareUpdateChannel": "release",
   "surfaceAddresses": [
    "<public ipv4>/22555",
    "<public ipv4>/25109",
    "<public ipv6>/22555",
    "<public ipv6>/25109",
    "<public ipv6>/9993",
    "<private ipv4 assigned via RouterA>/22555",
    "<private ipv4>/22555",
    "<private ipv4>/25109",
    "<private ipv4, router>/1303",
    "<private ipv4, router>/1302"
   ],
   "tertiaryPort": 22555
  }
 },
 "online": true,
 "planetWorldId": <id>,
 "planetWorldTimestamp": 1644592324813,
 "publicIdentity": "<id>",
 "tcpFallbackActive": false,
 "version": "1.12.0",
 "versionBuild": 0,
 "versionMajor": 1,
 "versionMinor": 12,
 "versionRev": 0
}

19f302f0a2 1.10.6 LEAF      18 DIRECT           # zt02
62f865ae71 -      PLANET   425 DIRECT
a9919fe10c 1.12.0 LEAF      -1 RELAY             # zt04

And from another device in another private network (NAT2), can only direct access zt02 and zt03, but zt01 and zt04 is under relay status.

All these setup used to be work(I mean zt01,zt04 can be accessed directly from another private network behind NAT2)

I think I should get all device could be directly access in case I have a public ip.

Start by reviewing the reported topology, the zt04 info -j output, and the peers output showing DIRECT versus RELAY status. Reproduce the NAT0 and NAT2 paths if possible, then determine why zt01 and zt04 cannot establish direct access; done means the cause is identified and a confirmed fix or documented limitation is available.