I’m not behind CGNAT/double NAT but I’m curious, can you use IPv6 to bypass that?

Tailscale would work as another user said. You could run TOR too. I’ve got a TOR service that I can SSH into for “plan b” if my VPN is down. It doesn’t need port forwarding.

https://nvd.nist.gov/vuln/detail/CVE-2025-34158

Maybe Picoshare

I’d recommend pihole->dnscrypt->mullvads DNS server.

Move the ports you are exposing from the qbit container to the wireguard container. The VPN container should be the only one exposing ports in this case.

But like someone else said, the gluetun image works really well for this.