I wonder if you could subscribe with mosquitto_sub to a host behind NAT.
like mosquitto_sub -h x.x.x.x:1183 -t #
If you have a external Ip with a broker but also other broker behind the external Ip.
Or is it impossible to workaround without ssh or similar to get “inside” the network first
The client has to initiate the connection, so if the broker does not have an external IP it would not be possible to connect to it directly. You may be able to configure port forwarding on the external router to have port 1883 sent to the broker in the private IP.