I’ve had a further look at VLAN solutions for CGNAT as I may shift my main system to mobile at some point, and I’ll have to live with CGNAT.
My requirements are that: the VLAN client on the BI Windows machine runs as a service that starts with Windows (as BI itself does); connecting a client to the VLAN server doesn’t require any port forwarding; I can include other Windows, Linux and Android devices as VLAN clients; the VLAN is secure; and its free. I think that covers everything, but rules out my exiting options of ngrok, Hamachi and Neorouter.
Fortunately there is a solution, ZeroTier, that I’ve got up and running and seems to be working brilliantly. For me it has the additional functionality of being able to include Home Assistant servers and my Teltonika mobile routers as clients, so it super useful.