Web code is only allowed to send TCP packets (websockets go on port 80 by default, just like HTTP). It also doesn't allow crafting special packets. pwnat's method relies on being able to send ICMP and UDP, which the browser won't.
So yes, it looks like some sort of further in-depth hackery would be required, or planting some sort of SBC in the building on the network. It's quite a bit more infeasible than I had initially thought.