I have a Firewalla. They run a WireGuard proxy (sort of like a DERP in Tailscale), so I use that. It actually works more often than Tailscale somehow, and since it's just WG, it works perfectly with my GL.iNet travel hotspots. Firewalla also has ad blocking baked in with less restrictive blacklists, so that's what I use.

Before I got the FW, I used Tailscale and AdGuard Home.