CGNAT workaround via WireGuard is solid. the tradeoff is your LND REST port is now reachable through the tunnel, so keep that macaroon scope tight. read-only or invoices-only macaroon is worth the extra step.