Tailscale is able to hole punch in scenarios where UPnP is disabled (just good practice) as well as many NAT environments.