Tailscale's strength is getting through double CGNAT of big ISPs.

Still requires your self-hosted VSP that is NOT behind a CGNAT.