diff --git a/auto_tests/dht_test.c b/auto_tests/dht_test.c
index e18f182a..11406554 100644
--- a/auto_tests/dht_test.c
+++ b/auto_tests/dht_test.c
@@ -303,7 +303,7 @@ static void test_addto_lists(IP ip)
     Networking_Core *net = new_networking(NULL, ip, TOX_PORT_DEFAULT);
     ck_assert_msg(net != 0, "Failed to create Networking_Core");
 
-    DHT *dht = new_DHT(NULL, net);
+    DHT *dht = new_DHT(NULL, net, true);
     ck_assert_msg(dht != 0, "Failed to create DHT");
 
     IP_Port ip_port = { .ip = ip, .port = TOX_PORT_DEFAULT };
@@ -440,7 +440,7 @@ static void test_list_main(void)
         IP ip;
         ip_init(&ip, 1);
 
-        dhts[i] = new_DHT(NULL, new_networking(NULL, ip, DHT_DEFAULT_PORT + i));
+        dhts[i] = new_DHT(NULL, new_networking(NULL, ip, DHT_DEFAULT_PORT + i), true);
         ck_assert_msg(dhts[i] != 0, "Failed to create dht instances %u", i);
         ck_assert_msg(dhts[i]->net->port != DHT_DEFAULT_PORT + i, "Bound to wrong port");
     }
@@ -584,7 +584,7 @@ START_TEST(test_DHT_test)
         IP ip;
         ip_init(&ip, 1);
 
-        dhts[i] = new_DHT(NULL, new_networking(NULL, ip, DHT_DEFAULT_PORT + i));
+        dhts[i] = new_DHT(NULL, new_networking(NULL, ip, DHT_DEFAULT_PORT + i), true);
         ck_assert_msg(dhts[i] != 0, "Failed to create dht instances %u", i);
         ck_assert_msg(dhts[i]->net->port != DHT_DEFAULT_PORT + i, "Bound to wrong port");
     }
diff --git a/auto_tests/onion_test.c b/auto_tests/onion_test.c
index d84c3991..329d7371 100644
--- a/auto_tests/onion_test.c
+++ b/auto_tests/onion_test.c
@@ -144,8 +144,8 @@ START_TEST(test_basic)
     IP ip;
     ip_init(&ip, 1);
     ip.ip6.uint8[15] = 1;
-    Onion *onion1 = new_onion(new_DHT(NULL, new_networking(NULL, ip, 34567)));
-    Onion *onion2 = new_onion(new_DHT(NULL, new_networking(NULL, ip, 34568)));
+    Onion *onion1 = new_onion(new_DHT(NULL, new_networking(NULL, ip, 34567), true));
+    Onion *onion2 = new_onion(new_DHT(NULL, new_networking(NULL, ip, 34568), true));
     ck_assert_msg((onion1 != NULL) && (onion2 != NULL), "Onion failed initializing.");
     networking_registerhandler(onion2->net, 'I', &handle_test_1, onion2);
 
@@ -222,7 +222,7 @@ START_TEST(test_basic)
     }
 
     c_sleep(1000);
-    Onion *onion3 = new_onion(new_DHT(NULL, new_networking(NULL, ip, 34569)));
+    Onion *onion3 = new_onion(new_DHT(NULL, new_networking(NULL, ip, 34569), true));
     ck_assert_msg((onion3 != NULL), "Onion failed initializing.");
 
     random_nonce(nonce);
@@ -285,7 +285,7 @@ static Onions *new_onions(uint16_t port)
     ip_init(&ip, 1);
     ip.ip6.uint8[15] = 1;
     Onions *on = (Onions *)malloc(sizeof(Onions));
-    DHT *dht = new_DHT(NULL, new_networking(NULL, ip, port));
+    DHT *dht = new_DHT(NULL, new_networking(NULL, ip, port), true);
     on->onion = new_onion(dht);
     on->onion_a = new_onion_announce(dht);
     TCP_Proxy_Info inf = {{{0}}};
diff --git a/other/DHT_bootstrap.c b/other/DHT_bootstrap.c
index 8cb6a8d0..7a2f7d13 100644
--- a/other/DHT_bootstrap.c
+++ b/other/DHT_bootstrap.c
@@ -27,8 +27,9 @@
 #endif
 
 #include "../toxcore/DHT.h"
-#include "../toxcore/LAN_discovery.h"
 #include "../toxcore/friend_requests.h"
+#include "../toxcore/LAN_discovery.h"
+#include "../toxcore/tox.h"
 #include "../toxcore/util.h"
 
 #define TCP_RELAY_ENABLED
@@ -120,7 +121,7 @@ int main(int argc, char *argv[])
     IP ip;
     ip_init(&ip, ipv6enabled);
 
-    DHT *dht = new_DHT(NULL, new_networking(NULL, ip, PORT));
+    DHT *dht = new_DHT(NULL, new_networking(NULL, ip, PORT), true);
     Onion *onion = new_onion(dht);
     Onion_Announce *onion_a = new_onion_announce(dht);
 
diff --git a/other/bootstrap_daemon/src/tox-bootstrapd.c b/other/bootstrap_daemon/src/tox-bootstrapd.c
index f2816ddf..ce1ac5eb 100644
--- a/other/bootstrap_daemon/src/tox-bootstrapd.c
+++ b/other/bootstrap_daemon/src/tox-bootstrapd.c
@@ -33,6 +33,7 @@
 #include <sys/stat.h>
 
 // toxcore
+#include "../../../toxcore/tox.h"
 #include "../../../toxcore/LAN_discovery.h"
 #include "../../../toxcore/TCP_server.h"
 #include "../../../toxcore/onion_announce.h"
@@ -243,7 +244,7 @@ int main(int argc, char *argv[])
         }
     }
 
-    DHT *dht = new_DHT(NULL, net);
+    DHT *dht = new_DHT(NULL, net, true);
 
     if (dht == NULL) {
         write_log(LOG_LEVEL_ERROR, "Couldn't initialize Tox DHT instance. Exiting.\n");
diff --git a/testing/DHT_test.c b/testing/DHT_test.c
index df029d41..46e6ff7c 100644
--- a/testing/DHT_test.c
+++ b/testing/DHT_test.c
@@ -193,7 +193,7 @@ int main(int argc, char *argv[])
     IP ip;
     ip_init(&ip, ipv6enabled);
 
-    DHT *dht = new_DHT(NULL, new_networking(NULL, ip, PORT));
+    DHT *dht = new_DHT(NULL, new_networking(NULL, ip, PORT), true);
     printf("OUR ID: ");
     uint32_t i;
 
diff --git a/toxcore/DHT.c b/toxcore/DHT.c
index 9a6996b2..5185353e 100644
--- a/toxcore/DHT.c
+++ b/toxcore/DHT.c
@@ -2088,6 +2088,10 @@ static uint16_t NAT_getports(uint16_t *portlist, IP_Port *ip_portlist, uint16_t
 
 static void punch_holes(DHT *dht, IP ip, uint16_t *port_list, uint16_t numports, uint16_t friend_num)
 {
+    if (!dht->hole_punching_enabled) {
+        return;
+    }
+
     if (numports > MAX_FRIEND_CLIENTS || numports == 0) {
         return;
     }
@@ -2577,7 +2581,7 @@ static int cryptopacket_handle(void *object, IP_Port source, const uint8_t *pack
 
 /*----------------------------------------------------------------------------------*/
 
-DHT *new_DHT(Logger *log, Networking_Core *net)
+DHT *new_DHT(Logger *log, Networking_Core *net, bool holepunching_enabled)
 {
     /* init time */
     unix_time_update();
@@ -2594,6 +2598,9 @@ DHT *new_DHT(Logger *log, Networking_Core *net)
 
     dht->log = log;
     dht->net = net;
+
+    dht->hole_punching_enabled = holepunching_enabled;
+
     dht->ping = new_ping(dht);
 
     if (dht->ping == NULL) {
diff --git a/toxcore/DHT.h b/toxcore/DHT.h
index 54ab9121..db05fecc 100644
--- a/toxcore/DHT.h
+++ b/toxcore/DHT.h
@@ -238,6 +238,8 @@ typedef struct {
     Logger *log;
     Networking_Core *net;
 
+    bool hole_punching_enabled;
+
     Client_data    close_clientlist[LCLIENT_LIST];
     uint64_t       close_lastgetnodes;
     uint32_t       close_bootstrap_times;
@@ -435,7 +437,7 @@ void DHT_save(DHT *dht, uint8_t *data);
 int DHT_load(DHT *dht, const uint8_t *data, uint32_t length);
 
 /* Initialize DHT. */
-DHT *new_DHT(Logger *log, Networking_Core *net);
+DHT *new_DHT(Logger *log, Networking_Core *net, bool holepunching_enabled);
 
 void kill_DHT(DHT *dht);
 
diff --git a/toxcore/Messenger.c b/toxcore/Messenger.c
index d4c4526e..be311fa1 100644
--- a/toxcore/Messenger.c
+++ b/toxcore/Messenger.c
@@ -1934,7 +1934,7 @@ Messenger *new_messenger(Messenger_Options *options, unsigned int *error)
         return NULL;
     }
 
-    m->dht = new_DHT(m->log, m->net);
+    m->dht = new_DHT(m->log, m->net, options->hole_punching_enabled);
 
     if (m->dht == NULL) {
         kill_networking(m->net);
diff --git a/toxcore/Messenger.h b/toxcore/Messenger.h
index 23bd0009..8f9a83a9 100644
--- a/toxcore/Messenger.h
+++ b/toxcore/Messenger.h
@@ -77,6 +77,8 @@ typedef struct {
     uint16_t port_range[2];
     uint16_t tcp_server_port;
 
+    uint8_t hole_punching_enabled;
+
     logger_cb *log_callback;
     void *log_user_data;
 } Messenger_Options;
diff --git a/toxcore/tox.api.h b/toxcore/tox.api.h
index 40031830..33481cce 100644
--- a/toxcore/tox.api.h
+++ b/toxcore/tox.api.h
@@ -519,6 +519,11 @@ static class options {
      */
     uint16_t tcp_port;
 
+    /**
+     * Enables or disables UDP hole-punching in toxcore. (Default: enabled).
+     */
+    bool hole_punching_enabled;
+
     namespace savedata {
       /**
        * The type of savedata to load from.
diff --git a/toxcore/tox.c b/toxcore/tox.c
index c7d90871..6317d126 100644
--- a/toxcore/tox.c
+++ b/toxcore/tox.c
@@ -131,6 +131,7 @@ ACCESSORS(uint16_t, proxy_ , port)
 ACCESSORS(uint16_t, , start_port)
 ACCESSORS(uint16_t, , end_port)
 ACCESSORS(uint16_t, , tcp_port)
+ACCESSORS(bool, , hole_punching_enabled)
 ACCESSORS(TOX_SAVEDATA_TYPE, savedata_, type)
 ACCESSORS(size_t, savedata_, length)
 ACCESSORS(tox_log_cb *, log_, callback)
@@ -155,6 +156,7 @@ void tox_options_default(struct Tox_Options *options)
         options->ipv6_enabled = 1;
         options->udp_enabled = 1;
         options->proxy_type = TOX_PROXY_TYPE_NONE;
+        options->hole_punching_enabled = true;
     }
 }
 
@@ -219,6 +221,7 @@ Tox *tox_new(const struct Tox_Options *options, TOX_ERR_NEW *error)
         m_options.port_range[0] = options->start_port;
         m_options.port_range[1] = options->end_port;
         m_options.tcp_server_port = options->tcp_port;
+        m_options.hole_punching_enabled = options->hole_punching_enabled;
 
         m_options.log_callback = (logger_cb *)options->log_callback;
         m_options.log_user_data = options->log_user_data;
diff --git a/toxcore/tox.h b/toxcore/tox.h
index ef738422..d6f6fb2f 100644
--- a/toxcore/tox.h
+++ b/toxcore/tox.h
@@ -575,6 +575,12 @@ struct Tox_Options {
     uint16_t tcp_port;
 
 
+    /**
+     * Enables or disables UDP hole-punching in toxcore. (Default: enabled).
+     */
+    bool hole_punching_enabled;
+
+
     /**
      * The type of savedata to load from.
      */
@@ -642,6 +648,10 @@ uint16_t tox_options_get_tcp_port(const struct Tox_Options *options);
 
 void tox_options_set_tcp_port(struct Tox_Options *options, uint16_t tcp_port);
 
+bool tox_options_get_hole_punching_enabled(const struct Tox_Options *options);
+
+void tox_options_set_hole_punching_enabled(struct Tox_Options *options, bool hole_punching_enabled);
+
 TOX_SAVEDATA_TYPE tox_options_get_savedata_type(const struct Tox_Options *options);
 
 void tox_options_set_savedata_type(struct Tox_Options *options, TOX_SAVEDATA_TYPE type);