Have you reached out to your ISP to see if they can give you a dynamic public IP? I recently swapped to a new ISP that was using CGNAT but after contacting their support team with my use case, they were happy to set me up with a public IP so I could continue my self-hosting.

OP in a couple of days

I actually did this for a few months until I saved up enough for a decent dedicated firewall appliance. Got a cheap PCIe 2x1GB NIC off Amazon and passed it directly to an OPNsense VM.

Honestly, it wasn’t that bad. The only downside is that that Proxmox server was just an old repurposed desktop PC that was super underpowered, so the VM only had like 2GB of RAM and that ended up being a bit of a bottleneck under load.