@erincandescent FWIW, bgp.tools used raw SCTP for quite a while for data backhual over the internet from IXs (and first gen customer agents) and had 0 issues with firewalls that the common internet stuff would claim you would have, I think the nuance is that if you are going to have issues connecting to a non "normal" (IE 443/22/80 etc) port then you are going to have issues with SCTP too, otherwise, it was totally fine.

These days bgp.tools's agent/IX backhaul uses a userspace SCTP stack for different reasons, but I still have a raw SCTP transport up my sleeve if I ever need it