Deploy a single-tenant VPN server with a static IP in the region you choose. IKEv2 with no app, VLESS for restrictive networks, a login per person, an exportable access log. Billed by the hour, no subscription.