https://tailscale.com/blog/introducing-tailscale-funnel/ is free for personal use
sure, it could be streamlined even more (currently it requires that you run "tailscaled -tun userspace-networking", possibly with a custom unix domain socket path, and then also run "tailscale up" to activate it)