WireGuard

WireGuard is a great, lightweight, VPN. It works simply by exchanging public keys (much like SSH). From the WireGuard website:

WireGuard aims to be as easy to configure and deploy as SSH. A VPN connection is made simply by exchanging very simple public keys – exactly like exchanging SSH keys – and all the rest is transparently handled by WireGuard. It is even capable of roaming between IP addresses, just like Mosh. There is no need to manage connections, be concerned about state, manage daemons, or worry about what's under the hood. WireGuard presents an extremely basic yet powerful interface.

A benefit to WireGuard is the built in IP roaming. For example, if you have a WireGuard "server" on a static IP, the "clients" can freely roam without any additional configuration.