I've been pretty impressed by the latest wireguard features, or maybe it's the systemd-networkd integrations, but it manages the routes and masquerade for you. Recovers from network outages automatically and never have to touch it.