Another option is a VPN as a service solution like tailscale. Tailscale does a lot of work to get around NAT and has some great articles on their blog about it. https://tailscale.com/blog/how-nat-traversal-works/
Oh I love tailscale, it is so performant and just works (mostly). However, I have used Tor for many years for this use case and still have it around as a fallback for machines that can be hard to reach spatially.
Wireguard is performant, tailscale makes it convenient
Is there a way of doing NAT hole-punching with Wireguard?