Sorry, I wasn’t clear enough before. My bad. Your friend needs to do the bridging, or do like you said, rent a vps, put wireguard on it and have your friend connect to the vps. I’ve never done it, however I’ve seen people host other services that way when they are stuck behind a CGNAT.