Just a thought. I have always had problems with snowflake and restricted NAT. Have you thought about running it as unrestricted? All NAT types can run snowflake as unrestricted. You can open a limited number of UDP ports and tell snowflake to only use those ports.
For example you can allow -let’s say- udp ports 10000-20000 through your firewall and then add this line to your docker-compose.yml
command: [ "-ephemeral-ports-range", "10000:20000" ]
and restart. You’ll show as having unrestricted NAT in the logs and you’ll be relaying far more traffic. The port range could be smaller in size or larger.