I just use a WireGuard tunnel between my OPNsense router and a VPC instance. Currently using the tiniest t4g AWS instance but it doesn't much matter what the upstream machine is, as long as it has a public IP. WireGuard is easy and I'm not so reliant on a 3rd party service.