I have personally gone the VPN route with wireguard. Right now I have it setup so that all of my servers connect to my wireguard server on the VPS. Then I simply either just point my reverse proxy at the wireguard IP address or setup a forwarding rule in IP tables. Also try to get a VPS that is located close as it will reduce the ping times if that is important to you. I also recommend that you keep services which you only need to like ssh not forwarded and either use tailscale or wireguard to connect when you need to. With regards to the switch it is theoretically possible to setup a special access point with port forwarding through a VPN but it is much more complicated. It might be easier to accomplish this with a more traditional VPN service as some providers specifically cater to individuals looking to use a VPN for online play.