Yep, and such a thing would never be allowed anyway because what network administrator will look at “yes random client devices can punch holes in my network from the outside to your not very securely assigned address” and rightfully say nope.

Here’s the attack:

- You want to get to A

- And you’re on a device B that has access to hole-punch-as-a-service but no direct access to A. Good network administrator / sysadmin!

- Attack NDP (ie ARP spoofing but IPv6 flavored) to trick the firewall just for a moment that you’re A [1] and request the port be opened to your evil server C on the public internet.

- Oops.