I rent a VPS and run wireguard on it. My HA server connects to it via the wireguard addon as do any clients that are outside my network. I use cell service for my ISP so I can't open ports to the world even if I wanted to.