i use Tailscale on everything these days (or use Headscale if you want to self host the control plane). with the free plan you get up to 100 devices on a "tailnet", just set the right ACLs to only allow the remote connection ports of choice, pair it with self hosted RustDesk, and you should be good to go. the NAT traversal of Tailscale is pretty good from what i've observed, but sometimes you might get stuck on a relay (called a DERP) if it can't get across the firewall(s).