It’s all built in to roon now, if you use UEFI boot. I just sorted it all out, saves having another computer on. 
Can you expand on this please?
It’s not built into Roon at all this is very misleading. The latest version of RoonOS the operating system that is for the Nucleus or self build Rock on supported Intel Nuc systems now has VPN as part of the operating system. This is available for systems using UEFI boot for Rock and not older ones using the legacy bios. You need to do a full new install on those machines to bring it up to the latest version. If you don’t use a RoonOs machine then this is all up to you to set up on a pc yourself.
Ahh, ok. That’s what I was thinking as well.
As I mentioned, I’m running Roon on my NAS, so this would not be useful in my case.
Not at all. You can install Tailscale on your NAS it supported on a number of them and then have access via this rather than port forwarding.
I think the best solution is as suggested where I VPN into my router and just run the regular Roon app.
Thanks everyone for your input. Much appreciated.