I am at the design stage of an embedded system which requires an incoming connection to be forwarded through a consumer-grade router. This will carry an encrypted connection eventually.
I see three options here:
- Setup port-forwarding from the router to the system with HTTPS.
- Use UPnP to setup temporary port forwarding with HTTPS.
- Use UDP hole punching and custom encryption on top.
The other end of the connection is a mobile device which will not have a public IP with a controllable firewall, so cannot be connected to in the other direction.