Twingate.
Outbound-TLS ZTNA is what survives DPI. No public IP, no inbound ports, no handshake to fingerprint.
Default remote-access fabric where the network inspects TLS. Clients dial out over TLS on 443, so there is nothing listening to probe and nothing for middleboxes to throttle by signature.
Proved out on the RDS cutover documented in ~/work/rds-migration-tailscale-to-twingate. It replaced an IPsec tunnel that could not hold through aggressive filtering.
The proof was the Oman cutover. tailscale netcheck from affected branches reported UDP: false as ISP DPI fingerprinted and dropped WireGuard handshakes, so Twingate connectors dialing out over TLS 443 restored Tally Prime ERP access through double NAT with no public IP and no inbound firewall rules. See ~/work/rds-migration-tailscale-to-twingate.