I can recommend tailscale for creating private networks. It has a generous free tier and would reduce the attack surface considerably compared to ngrok
Better yet would be setting up your own wireguard instance and not relying on free lunches. But as far as free lunches go tailscale would be my preferred option
tailscale has a much better chance to work when you need it most. WireGuard is blocked by too much stuff.
Head scale is a good middle option - it uses Tailscale’s DNS system but you are able to control your network as you would with Wireguard