I use wireguard for all that, it is self hosted and I do not have to have accounts elsewhere, once I have my OpenWRT up and running and my static IPs running to it I will move wireguard there. I have QR codes setup so that I can give people a taste of pihole for a short period of time when I am away from my LAN, of course when they are on my guest wifi they get pihole the whole time.

Just a side note for any 2FA I use vaultwarden.