I double NAT. My ISP box gives off WiFi for consoles, guests, some IOT. UPNP is enabled and I generally don’t care what goes on there.

My FW is an OPNSense box and everything I do is behind that. I’ve opened ports, run Tailscale, etc and have had no problems at all. All it is is an extra device to open a NAT rule in if I want to open something up.