Does anyone know if you can use holepunch for a dedicated server? My impression is not.

Assuming I'm interpreting the notes in the code (below) correctly:
sv_public 0 = private LAN
sv_public 1 = IP address listed publicly
sv_public 2 = use broker via holepunch

However, elsewhere I've read in the code that if the server is dedicated sv_public is set to 1.

So maybe you can only set this through the UI on a hosted server.

CODE:
-1: Fully blocks all inbound connections.\n0: Disable subscribing to master servers (for private lan-only games).\n1: Subscribe to public master servers. Your IP address will be listed publicly. Make sure your Router/NAT+Firewall are set to allow inbound connections.\n2: Subscribe to a broker master, allowing firewall hole punching.