WebRtc usually manages to punch a hole in my experience (which, to be fair, isn't with particularly hostile network architecture), but I believe it does go through a middle man relay if that fails.