I have CGNat and I can reach my pi from anywhere through wireguard (using Tailscale). Still can't host anything externally visible though (as you know)