To clarify: I'm talking about using the incremental node location mechanism to find the closest N nodes to a given key, except instead of the key being eg. a content hash, it's *also* a node ID.
And then each peer just maintains a session with the N closest publicly-connectable nodes to it, and someone wanting to connect *to* a firewalled/NATed peer finds those same N closest connectable nodes and asks one of them to relay traffic to the target peer for it.
@joepie91
i am not 100% sure if dat or in particular hyperdht/hyperswarm does it this way, but...
thats exactly what dat does.
the kademlia based dht participating odes also help with holepunching and optionaply relaying just as you initially suggested