[superleo2020]

Having supported this for over ~15 years. This is where I'm at...

pfSense router sits in a VM. Router is connected via s2s OPVN back to the center of a VPN host (star - many s2s's). OVPN configs use DNS for lookup, with IP as retry - static as it may be you never know! Modems sit as-factory (double-nat) just in case ISP support is needed or I want to swap an ISP out. They don't need forwarded ports for their consumption. Failover (s2s VPN traffic only) is via 4G on a little mini router. 250MB a month for free.

Windows machines (because of used peripherals) have RDP and VNC. I literally type their DNS and provided I'm within a home network or on the roadwarrior client, I can get straight in. All machines are connected to smart plugs and turn on automatically on powerloss restore. Server is some fancy AMT thing that lets me VNC in to mount ISOs, get to BIOS etc, but never used it. This is all very stable and has worked flawlessly for a decade.

They've slowly acquired Android devices over time (phones, tablets, and shields). This has been troublesome for support. Tried Visor at first but it often would fail. scrcpy has been more successful. But the real issue is often the ADB debugging would be disabled randomly. This remains a thorn. And of course, it isn't ideal to have ADB on as they roam from Wifi to wifi!