We use hole punching and a kind of stun server, although in maidsafe fashion no stun server (or any servers).
1: So a node sends a udp packet (router keeps the port open for 20-30 secs as udp is connectionless, it needs to wait on reply).
2: Routing picks this up and tells the other node the IP:PORT to connect to.
3: The other node has done the same and its nodes pick up its ip:port
4: The nodes connect (via a connection called rendezvous)
5: Router traversed and the network can talk to the node through the router
There is a longer explanation here
Its pretty cool and a nightmare for p2p networks etc. This was a big thing when we got it all working.