Both tailscale (partially open source) and nebula (entirely open source, you have to host the "lighthouses" which assist in NAT punching yourself) do this. (Als

Both tailscale (partially open source) and nebula (entirely open source, you have to host the "lighthouses" which assist in NAT punching yourself) do this. (Also tinc.) Yggdrasil is basically researching a replacement for BGP, so hole punching isn't a priority. (There is a 3rd party project that does something like this for Yggdrasil, but nebula is probably the better fully open source option.)