How to connect to servers in private network?

I’m developing a MOBA game, say I have 100 VPS in an IaaS cloud, 1 of them is a login server which has a public IP address, the other 99 are UE4 dedicated game server and only have private IP address. When login server receives request to create a new game session, it spawns a new instance on 1 of the 99 game servers.

Now here is the problem, how the client connect directly to the newly created game session?

Google shows some results:

  1. Port forwarding: actually my IaaS provider do have an optional router where I can config port forwarding through admin console manually or through an RESTful API, but I don’t know if this still holds for other IaaS providers. In my situation I should call the RESTful API to add/remove port forwarding dynamically when new game session is created/destroyed, which is not a trivial task and is incompatible between different IaaS providers.

  2. NAT Punch-through: several blog posts suggest this as a solution for P2P game session (server is hosted on player’s own personal computer). I thought this is the same situation I’m facing with IaaS cloud so it should work for me, but one comment (I can’t find the original post for now) says something like “NAT punch-through is hard to get right and depends on router devices, a better solution is change your game from P2P to client/server architecture”. So I’m really confused how client/server architecture can solve this when your servers still sits behind a NAT device!?

  3. There is a STUN protocol which looks like a standardized NAT Punch-through.

  4. Put a proxy/agent server between the client and the server, which forwards all traffics between them. A standardized version is a TURN protocol.

Unity is using the NAT Punch-through approach, but unfortunately some posts in UE4 forum says UE4 has no built-in support for this right now, so one must implement it by himself (good news there are middlewares like RakNet can do this).

This seems like a common problem to all MOBA genre games, so I wonder how they handled this.
Should I go the NAT Punch-through path and integrate RakNet into my UE4 project? Or there are some better solutions I’m missing?