Went down the NAT hole punching rabbit hole far enough to write a basic STUN client before running into why most hole punching literature is about UDP and not TCP: both peers must simultaneously open connections to each other in order for (most) NATs to behave properly. STUN will let you know your socket's public address and port, but it won't help you rendezvous with another peer. Learned a lot, but somewhat of a dead end. This page has probably the best and most understandable explanations of various hole punching scenarios: https://bford.info/pub/net/p2pnat/
@dthompson and most NA hosting and internet providers now have some IPv6 path, though it sadly still takes manual effort in many cases