We'll implement a VPN gateway IPSec/IKEv2 because it's natively supported natively both by clients (Linux/Windows/macOS) and the server (OpenBSD), no extra software required.