turns out? I'm just an idiot, enable UDP punching totally did work behind pfsense, went right through it like butter. Problem solved, layer 8 issue