This is a really nice explanation! I was also considering the birthday paradox to guess through a hard nas. It seems that the cgnat I'd like to traverse uses certain port ranges which could ease the guessing (I've read about nat traversal helpers to predict the ip address and ports). It would also be nice to do some research on NAT ALGs, it would be cool to fake a FTP connection to open an incoming port on the NAT gateway!