You could set up a do-nothing punch-through server: http://www.mindcontrol.org/~hplus/nat-punch.html. Basically, either you have to set up a central server and use a client-server model or you have to set up a central server to punch-through the NAT, which would be the firewall, to allow each client to talk to each other.