can the apiserver connect to the Kubelet port of a node through CNI-provided network?
Taking under consideration how kubectl exec works and looking at Weave Net documentation makes it impossible to fix the cluster connectivity problem with Weave CNI.
Weave uses the underlying network for sending a packet to the node. I can't find any information saying that it is allowed to put the cluster node behind the NAT. More details can be found here
Therefore it is impossible to work around this issue as you suggested.
I hope it helps.