Is there any official documentation here for the practice of making clients directly reachable, other than "enable UDP punching," which isn't going to work in enterprise environments?