There's ways to punch through cgnat with tailscale, netmaker

They don't do split tunneling? That's dumb. I ended up going with netmaker a year or so ago instead of tail scale because I didn't think tailscale was completely selfhost. Then netmaker put their relay functionality behind a paywall so now I'm stuck on an old version and have to decide to update or not.