Tinc[1]?

[1]: https://github.com/gsliepen/tinc

tinc-vpn is great. I use it to build L2 mesh islands and then quagga to route between those.

Not sure if parent means wireguard, but my GitHub page has a way to get around cgnat using wireguard for use with a Nintendo switch (or any wifi/etc device that doesn't run an editable OS)

Wireguard is L3 not L2.

re: GP comment. It really does not matter which non-properietary solution one chooses. It is personal preference. I know what I like but others might not like it. There are many options to choose from. And (I hope) there will continue to be more.

True, but you can make a L2 mesh network with a bunch of WG endpoints with tools built into the linux networking stack easily:

https://gitlab.com/NickCao/RAIT

https://github.com/m13253/VxWireguard-Generator

Hopefully referring to the (excellent) sshuttle:

https://github.com/sshuttle/sshuttle

... which allows you to turn any system you have an ssh login on into a VPN endpoint.

Wasn't sshuttle created by the now CEO of Tailscale?

Yes, I think so - original project is at:

https://github.com/apenwarr/sshuttle

... and I had not made that connection before ...