I'll give you a hint:
the gateway server sends the server list to the client. the server list includes server name, state, ip and so on.
so basically your server sends the internal 192.168.x.x ip address to the requesting client. then it gives the client a token to connect to that server (authenticated, and may connect to the gameworld - agentserver). since the 192.168.x.x of your server is an internal ip which cannot be accessed from outside (since every lan home network has such ip) the client cannot connect and the "token" expires.
that's the problem.
in other words this is what happens:
1- connection to gateway server
2-gateway server sends server name+state+ip to the client.
3-when logging in, the gateway server checks if userdata are true.
if yes, then the gateway server sends a "token ticket" to the agentserver saying "hey agentserver..XXX is going to connect to you. it's ok cuz he had the right user credentials".
the agent server knows then, that the computer that will connect through that token ID will be authenticated and bound to account XXXX.
5- the client now tries to connect to the agent server. he will show the agent server that token ticket which he received from the gatewayserver.
6-client cannot connect to the given IP because the given ip is a local lan ip.
7-gateway server sends a token-timeout.
in other words this means that the ticket which the gatewayserver was sent to the client expired and is no longer valid. to ensure nobody steals such token ;)
i hope this was clear enough to understand this server system.
if you use hamachi for your friends, it'll be enough.
since you surely have a dynamic ip, it's not possible to open the server for outside, because on every 24 hours - ip change- you would have to reconfigure all server configs with the new ip and you would have to give people a new media file with the new ip address in it. so stick to hamachi ;)
thank me :)