It’s worth reading a bit about sshuttle. It basically leverages ssh into a simple one way VPN as far as ergonomics and user experience go (but the underlying implementation is closer to opening LocalForward connections on demand).
Almost as easy: just setup a point to point WireGuard tunnel. I used sshuttle for remote Docker dev for a while, but found that WireGuard way outperforms it.
sshuttle is definitely no efficiency daemon - however, it only requires being able to ssh to the other side, amd run Python there, and that’s it - whereas for Wireguard you need root on the other side, a sufficiently new kernel (or building an out of kernel module) - it’s way better if you can use it but IME it isn’t “almost as easy” - sshuttle usually just works if you can ssh.
