UPNP + hairpin probing