This could just be my own confusement, but isn’t Netbird dependent on being able to maskerade the connection for machines that do not have netbird behind them? If you look in the firewall logs, does it display any IMCP logs to attempted locations?
My best guess here is that you are pinging the netbird agent no matter what IP you put in there. I could also be wrong, as it’s just a guess here. Since it has to go through the agent anyway to get into the subnet.