Reminder about the way Ubiquiti does this, as a vendor who wanted to provide users remote access to their own devices behind NAT: Unifi Cloud handles the auth and connection brokerage through a public portal, but you’re then connected straight to your own gear using your web browser (or one of the apps, if you choose). I can even turn all this off if I want to handle the remote access side of it myself.

Other vendors take note !