This runs a real STUN round-trip against a server we control, then checks the one thing a browser can't fake — whether the packet actually arrived.