Forwarding ports can be a pain, I admit, here in France you get a routeur supplied when you sign up for fiber, and of course they are all different. I got WireGuard with Duckdns working, though impossible to get just duckdns to work on it's own. And it was was far more difficult than just tailscale.
Use timeshift, easy peasy to set up. It's saved my bacon a couple of times now, only last week, when the kernel 6.4 came out, but my old nvidia driver wouldn't work with it. You just jump into tty, run timeshift --restore and chose a previous backup, takes all of ten minutes. I have it doing a back up every day to a second HD, keeping the last five, doesn't take up much space. I don't think there's an easier option than that.
I use NordVPN, works well with Arch, no gui just terminal, only about three times to get it logged, to the country you want to use, and running