That’s how all voip worked since forever and we also have a bunch of standard and public facing infrastructure to make it easier. All the ice, turn and friends.

It still needs something on the inside to talk to outside first, so the actual firewall should whitelist both outbound and inbound connections.

Than again, if you rely on perimeter, it’s a matter of time when someone figures out what’s your equivalent of high wiz jacket is.