Joe

struts in his fancy pants

Be careful of dualstack and IPv4-only VPNs. The client can discover and advertise the real IPv6 address, even if adequately firewalled. I’m not sure if gluetun addresses this risk.

edit: this should be considered a risk even if you don’t have IPv6 support today, as this could be enabled by your ISP in the future, then automatically enabled on your network by your router.

Welcome to the world of Carrier Grade NAT. 100.64.0.0/10 is reserved for this.

If you are lucky, you also have an IPv6 address. The catch is you need IPv6 on the client-side too.

A VPS or similar running wireguard and a proxy might bridge the gap.

It might also be possible to ask your provider for some port forwarding. Probably not, but check anyway.

Good luck!