Good article from Tailscale on how direct connections is established, even when both nodes is behind NAT: https://tailscale.com/blog/how-nat-traversal-works