Totally unnecessarily complicated though. Just setup Wireguard, Caddy and some routing.

Caddy supports mTLS so if your client apps support it you could put everything behind client certs (assuming your services support it)

You also could use plain Wireguard since it might be simpler if you have the option to open up the firewall. I personally use netbird since I’m behind CG nat

I would also deploy IPv6 since it will help a lot of performance on carrier grade Nat networks like mobile data.

BSD is dated at this point. It is still being maintained but not nearly as much.

Rust would not of fixed this

Rust isn’t magical

And it is no longer trying to clone Minecraft. They are moving beyond.