Selfless plug: https://gist.github.com/gordol/d3f66e5fa0a53a9ccef30b7788504...

UDP hole punching is pretty straight forward.

This does it securely using SSH.