Tailscale can punch through NAT but requires outgoing internet access