You can set up relay nodes in the Netmaker config, and enable them only for those nodes behind NAT that need relaying. I’ve generally had good experience with Netmaker—when it works, it works—but several times it auto-updated and wiped my network config in the process.
What is your experience with Netbird vs Netmaker?
Tailscale doesn’t require you to wrestle with certs or the networking setup required to do NAT traversal. And they do it well, you don’t have to wonder whether you’ve screwed something up that’s degrading NAT traversal only in certain conditions. It just works. That said, I’ve been through the wringer already on these topics so Headscale is not painful for me.
Does Headscale require additional work to deal with NAT traversal on clients? Or is it just for the controller node itself?
For what it’s worth, I usually install Ubuntu Server instead of Debian because it comes with a few more things out-of-the-box that I would install anyway. I have several installations of 22.04 that have been upgraded since 16.04 and they work no problem. (I also have a few Debian installations working similarly well.)
Here is a script to easily install WireGuard and generate client config files for any server: https://github.com/Nyr/wireguard-install