Tailscale is pretty much the default option when you want to access anything remotely. It's definitely the option most people will give you when you ask them for recommendations. There's a good reason for that: Tailscale handles NAT traversal automatically, usually establishes direct encrypted connections, and can always fall back to a Tailscale Peer Relay or DERP when there's no direct path.