single NAT usually works fine with no need to relay. Only issue may be connecting to another node that is also behind NAT; then a relay for one of the nodes maybe required