If you want a TLS tunnel, I can vouch for stunnel being awesome.
Discussion
I have built my own :)
The only exposed ports on my router are fake 80, 443, 8080 and 8443 - it's fun x)
But in reality everything is routed through my VPN with my VPS as the headend - so, effectively, I have my own! ^-^
It's a Headscale setup, really neat piece of kit!
It looks very minimaliatic. I like it!
