You can go one step further and instead of separate ICMP ECHO trace, use existing HTTP TCP connection between client's browser and your web server. That way you can traverse client-side NAT and/or stateful firewall.