UDP hole punching works well for full-cone and restricted-cone NATs, but is nearly ineffective against symmetric NATs, hence the need for DERP relay.