Networks and addresses
WireGuard
A small, fast VPN protocol built on modern cryptography. One key pair per side, one UDP port, and it works behind NAT.
WireGuard is a VPN protocol that fits in a few thousand lines of code. Each side has a public and private key; a tunnel is a pairing of keys plus the addresses allowed through it. There is no certificate authority, no negotiation of cipher suites and no state to log in to: a peer that presents the right key and a valid handshake is in.
It runs over UDP on any port you choose, which is why it works from behind NAT and CGNAT: the side behind NAT sends the first packet, the other side answers to wherever it came from, and a keepalive every 25 seconds keeps the mapping open. It is built into the Linux kernel and available on every common router OS, phone and desktop.
Besides the usual VPN uses, it is what providers use to route a public IP address to equipment that has none: the tunnel comes up from your side, and traffic for the public address flows down it to your router.