I’m behind CGNAT with my ISP. I have a VPS which I use to tunnel traffic back to my home network with Wireguard. That gets terminated on the outside of my router and specific ports get forward in from there. Works well enough.