Tailscale simp here, been using this feature since it launched in beta, can't believe it didn't exist earlier.

This solved every last remaining problem of my CGNAT'd devices having to hop through STUN servers (with the QoS being noticable), now they just route through my own nodes.