i use fireguard through tailscale to access multiple machines over ssh, with their setup i was able to reduce exposure as i no longer need to open a port on the router

tailscale does this with their DERP servers

i doubt netmaker doesn't have an alternative to connect machines behind nat routers; that would be a serious disadvantage for soho setups