I have used tailscale for this in some situations and its free :)
Discussion
start9 also lets you run tailscale on it
https://github.com/angristan/wireguard-install
i used to wish i could set up SSH tunnels back in the day, but they are so clunky
this installer script is so dead simple you will never want to live without wireguard tunnels ever again
a few more pieces of tooling and IMO this is essential infra gear... especially a simple script to set up an SSH connection that only goes over WG, so you don't get endlessly spammed by SSH login scanners
wireguard is so dead simple i can't begin to reccommend enough to learn how to set it up
it uses much the same cryptography as nostr also, i think it uses faster ChaCha CSPRNG (rather than AES)