would tailscale maybe help? don’t need to expose ports and could have one source machine on that network with it and send wol from there