+1 for Zerotier. I really like wireguard, but Zerotier is so much easier and quicker to set up from scratch. If wireguard had ACLs and ipam built-in, it probably would probably win me over.