This isn’t a solution to your issue, but a suggestion:

Since you are already using Cloudflare for your domain name, and I assume they gave you some nameservers to use, why not explore the Cloudflare Tunnels/ZeroTrust? Cloudflare Tunnels don’t care if you are behind a dynamic IP, or cgnat. Cloudflare is unconcerned with what ports you open on your router/firewall. You don’t even have to adjust your UFW firewall settings. Cloudflare punches through all that with a tunnel in to your server and tunnel out to the internet.

Admittedly, it did take me a couple tries to get everything worked out, but once I did, it’s easy peasy from there. If you decide this route, I’d be more than happy to clean up some of my notes and share them with you. Might help…might not. LOL