Annoyingly, this will not work over CGNAT as far as I know - the tunnel needs 'both ends' to be accessible directly from each other I think.