Ah, I see where I got confused. Yeah, CGNAT isn’t very common around here. I don’t think I’ve ever run into an ISP that uses it. I can see how that complicates things.

You really don’t though. I use wireguard myself under the same scenario without issue. You just need to use some form of dynamic DNS to mitigate the potentially changing IP. Even if you’re using Tailscale you’ll still need to have something running a service all the time anyways, so may as well skip the proxy.