This blog post[1] may interest you. As you suggested, the workflow seems to be: 1. Try various techniques that might trick the firewalls on both ends to let th

This blog post[1] may interest you. As you suggested, the workflow seems to be: 1. Try various techniques that might trick the firewalls on both ends to let the connection through. This requires a relay for the initial negotiation only. 2. If (1) fails, then use a relay for everything. [1]: https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/