https://zerotier.com does a very nice job of NAT "bouncing", free (hosted) for up to 50 hosts, or you can run your own.

You end up with another "zt" interface, so you can apply firewall rules to that interface, separate from your main NIC(s), kinda like assigning your own VPC but for your laptop, etc. It only takes a few seconds to install the agent and join your private network, and it seems to reconnect quite nicely as well; if your network is private, you can force all new attempts to connect to be approved (where you can check the mac address first). Basically, it's exactly the right level of technical config traits with a simple interface.

(no affiliation, just a very happy user, but I will say that running your own seems to be a lot more difficult than it should be..)