TL;DR: I'm making a game with 3 components and I need two of them to have a virtual network connection similar to Argo tunnel. It has to be something I can distribute and I have complete control over the network without port forwarding one of the components.

I'm developing a game framework similar to Jackbox games. I already have a basic structure for how the game will work. It contains the following 3 parts:

• Client - Player's devices
• Proxy - A basic server to proxy traffic between the host and the clients
• Host - The machine that actually runs the game

I want to be able to distribute the host software to family and have it "just work," which is why I have the proxy server. The idea is that the host will connect to the proxy and provide the game through the proxy to the players. This begs the question, how am I going to pull this off? The proxy will have open ports, but in order to provide two-way communication between the proxy and the host, the host has to have exposed ports as well, right?

I'll break it down this way for clarification. Let's say the host is a simple web server providing files for a website. The proxy is cloudflare. You can run the cloudflared program on the host to create an Argo tunnel, exposing your web server to cloudflare's network without port forwarding, which in turn forwards traffic onto the clients.

That's the basic model I want to achieve, but I'm not sure how to make a system similar to an Argo tunnel since traffic needs to be proxied to a server I control rather than cloudflare's.

I've done a bit of research and have narrowed potential solutions to the following 3 ideas:

• Make a small OpenVPN server on the proxy server, distribute an OpenVPN client with the host that connects to the OpenVPN server on the proxy
• Instead of OpenVPN use ZeroTier as a similar configuration (in this case, I would need to run the controller myself if possible)
• Use websockets (This one I don't think would work since I don't think you can use websockets from within other websockets)