> No way to get around it.

Well...none of them are particularly easy, compared to punching holes in your local firewall. CGNAT takes you one step closer to digital serfdom (all hail our managed lords!)

That said, I'd say IPv6 would work if you have a public address and a tunnel broker for v4 only networks. Failing that, some kind of overlay (maybe a .onion?) or a reverse tunnel from someone who does have a public v4 address.