SSM Port Forwarding and Tailscale are your friend. I'm using a mixture of both with most staff WFH now and their home IP addresses not being static.

Tailscale especially is an amazing product though I've only had it running at work and home for around a month. All that said, a simple script as you pointed out is also great :)