> because some nodes are behind restrictive firewalls and NATs

That is just a weird turn of phrase on my part, will fix it. What I mean is:

because some nodes are behind restrictive firewalls and [restrictive] NATs.

In other words, most NATs work fine. Even if they don’t work fine, it has a process called a ‘reverse open’ where the inbound connection is requested by the receiving remote and the remote ‘captures’ and uses the same TCP socket.

Even if that doesn’t work, as you’ve discovered, you can run the backend Ona VPS.