Iroh will do hole punching through NATs. It will even work in many cases when there are NATs on both sides.

There are some limitations regarding some double NATs or very strictly configured corporate firewalls. This is why there is always the relay path as a fallback.

If you have a specific situation in mind and want to know if hole punching works, we got a tool iroh-doctor to measure connection speed and connection status (relay, direct, mixed):

https://crates.io/crates/iroh-doctor , can be installed using cargo install iroh-doctor if you have rust installed.