Allow the user who is needing help to be able to initiate the helping remote control session to the support person's client. This should get around most nat firewall considerations on the user's side. The support person should be able to more easily accommodate/adjust for the incoming firewall request than the user would be able to. Then the support person can control the user's machine.