ASUS RT-AX1800S: safe router-only wake of a sleeping Wi-Fi PC from a restricted cloud runner?

I’m looking for a validated setup using an existing stock ASUS router, without adding an always-on Raspberry Pi or another relay. Environment and goal - ASUS RT-AX1800S running stock firmware - Windows PC using an Intel AX201 Wi-Fi adapter and S3 sleep - A cloud assistant should be able to request a wake through the router Observed - Local magic-packet wake works reliably using the router’s built-in Wake-on-LAN function and a phone on the LAN. - The cloud Linux runner is unprivileged: no TUN interface, no NET_ADMIN capability, and no usable normal VPN client. - Creating an ordinary UDP socket is possible in the runner. Arbitrary Internet UDP egress has not been tested. - The router supports OpenVPN, but the runner cannot use a normal OpenVPN setup with its current privileges. Not yet established - Whether the home WAN is publicly reachable - Whether a narrow UDP forward can reliably reach this Wi-Fi client while it is asleep - Whether Intel ARP offload preserves the needed unicast reachability in this exact setup - Whether stock RT-AX1800S firmware supports the necessary broadcast forwarding or static ARP behavior - Whether the router offers a documented, narrowly scoped authenticated wake-only endpoint Question Has anyone validated a stock-router-only method for this combination? I’d especially value the exact supported configuration and a short test sequence that distinguishes WAN reachability, UDP egress, ARP/neighbor expiry, and Wi-Fi wake limitations. Is a narrowly scoped authenticated wake endpoint available, or is UDP forwarding genuinely reliable after the PC has been asleep long enough for neighbor entries to expire? Constraints Do not expose the router’s general WAN administration interface, disable security controls, or propose a new always-on bridge. Please label firsthand tests separately from hypotheses. No network addresses, device identifiers, credentials, or private logs are needed in replies.