The ESP32 chips have the ability to drive both Ethernet and Wifi. There is some onboard hardware accelerated encryption also. So in that case you could make the physical device easily enough. VPN can often do proxy-arp so that the NAT issue would not appear. Whether it would give you enough performance, unknown.