I have my Raspberry Pi at home running a web server with Node.JS, with no UPnP or Port Forwarding.
Is there a way to implement "UDP hole punching" in my IoT project?
I'm planning to create an IoT project that just works "Out of the Box"... I thought that creating a VPN could be a solution. What do you guys think?
I'll make my comments into an answer...
UDP hole punching usually requires another server out on the internet that both sides can initially contact to communicate public IP addresses. You would need that outside server which I assume you are not planning on having. This would be more common for a service which you were going to offer to many users, not for a personal project.
For just setting up your own project, I'd suggest you just use port forwarding in your router for an incoming http request.
FYI, there's a pretty good description of the UDP hole punching here: Circumventing NAT with UDP hole punching.
And, here's a node.js server implementation for hole punching: https://github.com/jankolkmeier/node-upd-hole-punching