+1 Self hosted TailScale MESH VPN
You only need a single instance running behind your firewall, if you advertise subnet routes. Will traverse any level of NAT, including CGNAT. Price of free tier is exactly right. Clients for every OS on planet earth.