diff --git a/core/node/groups.go b/core/node/groups.go
index 914e7c59b92..35a7c0db994 100644
--- a/core/node/groups.go
+++ b/core/node/groups.go
@@ -154,6 +154,7 @@ func LibP2P(bcfg *BuildCfg, cfg *config.Config) fx.Option {
 		fx.Invoke(libp2p.SetupDiscovery(cfg.Discovery.MDNS.Enabled, cfg.Discovery.MDNS.Interval)),
 		fx.Provide(libp2p.ForceReachability(cfg.Internal.Libp2pForceReachability)),
 		fx.Provide(libp2p.StaticRelays(cfg.Swarm.RelayClient.StaticRelays)),
+		fx.Provide(libp2p.HolePunching(cfg.Swarm.EnableHolePunching, cfg.Swarm.RelayClient.Enabled.WithDefault(false))),
 
 		fx.Provide(libp2p.Security(!bcfg.DisableEncryptedConnections, cfg.Swarm.Transports)),
 
diff --git a/core/node/libp2p/relay.go b/core/node/libp2p/relay.go
index d456179294b..33d958d5c9d 100644
--- a/core/node/libp2p/relay.go
+++ b/core/node/libp2p/relay.go
@@ -70,3 +70,15 @@ func AutoRelay(addDefaultRelays bool) func() (opts Libp2pOpts, err error) {
 		return
 	}
 }
+
+func HolePunching(flag config.Flag, hasRelayClient bool) func() (opts Libp2pOpts, err error) {
+	return func() (opts Libp2pOpts, err error) {
+		if flag.WithDefault(false) {
+			if !hasRelayClient {
+				log.Fatal("To enable `Swarm.EnableHolePunching` requires `Swarm.RelayClient.Enabled` to be enabled.")
+			}
+			opts.Opts = append(opts.Opts, libp2p.EnableHolePunching())
+		}
+		return
+	}
+}
diff --git a/docs/config.md b/docs/config.md
index 3a9fb90127c..69f7e523c79 100644
--- a/docs/config.md
+++ b/docs/config.md
@@ -99,6 +99,7 @@ config file at runtime.
     - [`Swarm.AddrFilters`](#swarmaddrfilters)
     - [`Swarm.DisableBandwidthMetrics`](#swarmdisablebandwidthmetrics)
     - [`Swarm.DisableNatPortMap`](#swarmdisablenatportmap)
+    - [`Swarm.EnableHolePunching`](#swarmenableholepunching)
     - [`Swarm.EnableAutoRelay`](#swarmenableautorelay)
     - [`Swarm.RelayClient`](#swarmrelayclient)
       - [`Swarm.RelayClient.Enabled`](#swarmrelayclientenabled)
@@ -1279,6 +1280,21 @@ Default: `false`
 
 Type: `bool`
 
+### `Swarm.EnableHolePunching`
+
+Enable hole punching for NAT traversal
+when port forwarding is not possible.
+
+When enabled, go-ipfs will coordinate with the counterparty using
+a [relayed connection](https://github.com/libp2p/specs/blob/master/relay/circuit-v2.md),
+to [upgrade to a direct connection](https://github.com/libp2p/specs/blob/master/relay/DCUtR.md)
+through a NAT/firewall whenever possible.
+This feature requires `Swarm.RelayClient.Enabled` to be set to `true`.
+
+Default: `false`
+
+Type: `flag`
+
 ### `Swarm.EnableAutoRelay`
 
 Deprecated: Set `Swarm.RelayClient.Enabled` to `true`.