You might try Zerotier or Tailscale running either natively or using an RPi as a bridge. Assuming your IT rules don't forbid it, both should be fairly resilient

You might try Zerotier or Tailscale running either natively or using an RPi as a bridge. Assuming your IT rules don't forbid it, both should be fairly resilient to simple/random port blocking. They're actually used by a lot of enterprises to provide secure p2p networks with automatic port punching and nat traversal.