diff --git a/tests/integration/test_network_join_scenarios.cpp b/tests/integration/test_network_join_scenarios.cpp
index 6d35cca..b74562b 100644
--- a/tests/integration/test_network_join_scenarios.cpp
+++ b/tests/integration/test_network_join_scenarios.cpp
@@ -370,6 +370,60 @@ TEST_CASE("network join: two extern peers can ping each other by IP (tap+relay)"
     CHECK(found_success);
 }
 
+TEST_CASE("network join: extern network can reach the outside (veth)", "[integration][root][net]") {
+    if (geteuid() != 0) {
+        SKIP("requires root");
+    }
+    auto image = find_busybox_fixture();
+    if (!image) {
+        SKIP("no busybox fixture (images/busybox.tar) -- see tests/setup-tests.py");
+    }
+
+    ScratchXdgDirs scratch;
+    TestNetwork network("selftest-extern-outside-veth", NetworkKind::extern_, /*veth=*/true);
+    REQUIRE(network.created());
+
+    // 8.8.8.8 -- real internet access confirmed available in this sandbox
+    // elsewhere this session, and network_bridge.h's own extern-uplink
+    // verification already proved outside reachability at the host-side
+    // level; this confirms it end-to-end through a real container join.
+    auto output = run_networked(*image, {network.name()},
+                                 {"sh", "-c", wait_for_eth0_then("ping -c 2 -W 2 8.8.8.8; echo RESULT=$?")});
+    auto lines = extract_marked_lines(output);
+    bool found_success = false;
+    for (const auto& line : lines) {
+        if (line == "RESULT=0") {
+            found_success = true;
+        }
+    }
+    CHECK(found_success);
+}
+
+TEST_CASE("network join: extern network can reach the outside (tap+relay)", "[integration][root][net]") {
+    if (geteuid() != 0) {
+        SKIP("requires root");
+    }
+    auto image = find_busybox_fixture();
+    if (!image) {
+        SKIP("no busybox fixture (images/busybox.tar) -- see tests/setup-tests.py");
+    }
+
+    ScratchXdgDirs scratch;
+    TestNetwork network("selftest-extern-outside-tap", NetworkKind::extern_, /*veth=*/false);
+    REQUIRE(network.created());
+
+    auto output = run_networked(*image, {network.name()},
+                                 {"sh", "-c", wait_for_eth0_then("ping -c 2 -W 2 8.8.8.8; echo RESULT=$?")});
+    auto lines = extract_marked_lines(output);
+    bool found_success = false;
+    for (const auto& line : lines) {
+        if (line == "RESULT=0") {
+            found_success = true;
+        }
+    }
+    CHECK(found_success);
+}
+
 TEST_CASE("network join: intern network has no route to the outside (veth)", "[integration][root][net]") {
     if (geteuid() != 0) {
         SKIP("requires root");