Plain old wireguard doesn't do double-nat hole punching. And many of the open-source alternatives (such as innernet) also don't.