Looking at the firewall logs, I think it should be easily possible to set things up to allow you to establish a connection using the same trick that the internal name and time servers do. Assuming the other end port-forwards sensibly. Ugh, I really should have gone to sleep an hour ago instead of looking into this.