There are two servers. The "mailbox server" helps with handshakes and metadata transfers, and is super-low bandwidth, a few hundred bytes per connection. The "transit relay helper" is the one that handles the bulk data transfer iff the two sides were unable to establish a direct connection.

I've been meaning to find the time to add NAT-hole-punching for years, but haven't managed it yet. We'd use the mailbox server messages to help the two sides learn about the IP addresses to use. That would increase the percentage of transfers that avoid the relay, but the last I read, something like 20% of peer-pairs would still need the relay, because their NATs are too restrictive.

The relay usage hasn't been expensive enough to worry about, but if it gets more popular, that might change.

The folks on the wormhole-rs fork (who appear to share your Github organization? [1]) already have NAT punching working 95+% of the time in my testing, so maybe what they're doing could be ported over to the Python implementation.

[1] https://github.com/magic-wormhole

The Rust implementation on Tailscale worked well for me. Except on a layer 7 firewall have to be quick to permit the connection or else it tries fallback.

That is just using normal STUN/TURN via another server that one of those developers is running

You cant make a p2p connection over a NAT without exposing a port on the public side of the NAT.

Go check out STUN and ICE.

The best article I've found about NAT traversal is this article from Tailscale: https://tailscale.com/blog/how-nat-traversal-works

is there a filesize limit for this?

That uses WebRTC, which uses the same NAT traversal tricks.

Not bad, though you don't even need STUN or ICE;

https://github.com/samyk/pwnat

https://github.com/samyk/slipstream

You can: https://en.wikipedia.org/wiki/Hole_punching_(networking)

You aren't guaranteed to be able to do that but in practice most times you can.