Can firewall punching work without proxying all traffic over the server?