You can use Cloudflare Argo tunnels (free service). It addresses your need. You can use this instead of port forwarding behind CGNAT.
Despite the public IP, their network is heavily firewalled afaik, hence all these problems.I found I could add "3internet" APN to my phone, When selected it connected to a real IP. Having said that I haven't been able to use direct port forwarding for many months from my router. I can get partial success by using L2P VPN then launch a client that specifies a forwarding port. The client shows the port as open.
I’m guessing they’ll do the good old exhaust unlock like they do on the 5G ones so your only option is return or use their network. This is usual you only if it’s three brand or used three firmware.I’m still waiting for someone to try the new Three router. I’m hoping it comes unlocked.