Does wsrep_cluster_address only accept the intranet IPs?
You can use any IP address in wsrep_cluster_address (you can use hostnames too). You need to make sure that all ports required are open for Galera communication (3306, 4444, 4567, 4568). There are many other reasons for "failed to get the other two working" so log files would be very helpful.