That is an awesome tool, but it requires a cooperating server inside your NAT; for security-breaching purposes, if you've got code execution on a machine inside the firewall, you've already won (against the firewall, anyway).
In other words, get sent to a domain that initiates the knock sequence. Other machine in waiting responds, and NAT traversal takes over, to any machines inside NAT.
The only real question is how much code is actually required to start this.
So yes, it looks like some sort of further in-depth hackery would be required, or planting some sort of SBC in the building on the network. It's quite a bit more infeasible than I had initially thought.