pfSense is good for this; OpenVPN is invariably inconvenient as hell to set up and use, but pfSense's implementation (along with the "client export" plugin that gives you what you need to set up devices, and unaccountably isn't part of the OOTB distribution) minimizes this inconvenience as well as anything I've ever seen - it's still inconvenient as hell, but somewhat less so than doing everything by hand.

The PDF can be accessed freely at https://archive.org/details/simplesabotagefi26184gut

The Tor restriction is pretty bad.

The hosted servers one I can rather understand and sympathise with, having been woken out of a sound sleep at 3am one too many times result of some hosted-space bot hammering our site and driving us offline.

A policy to institute CIDR-wide firewall rules on first sight tends to ensure sound sleep. Fairness be fucked.

(Vastly better tools for dealing with DoS would be a huge benefit generally, and much as I love Tor, it's really messing up with the Old Way of Resolving Asshats. I haet haet haet Cloudflare's incompetence, but understand why they do what they do. I'm not saying they've got the right answer though -- but again, that problem is hard.)