Kadmind uses channel bindings and thus does not work from behind a NAT. There seem to be no good reason for this other than hating our users. We may have to disable channel bindings for the gssrpc library to get this to go away.