punch

punch establishes direct UDP connections between peers behind NAT
without port forwarding, VPNs, or external tunneling binaries.
Discovers public endpoints via STUN, coordinates hole punching with
ICE-style candidate pairs, and encrypts the channel with AES-256-GCM.
Falls back to a relay broker when the NAT type prevents direct traversal.
Includes a minimal HTTP signaling server for local description exchange.
Works with vim.uv (Neovim) or luv (standalone LuaJIT).
Requires OpenSSL installed on the system for encryption and WSS.