Buy a VSP elsewhere and run Wireguard over IPSec