This is where homebrew router/firewalls are boss.
You don't even need to expose WOL to the open internet, just SSH/VPN to router, fire the WOL request off from inside the LAN.
pfSense for example has a full WOL module and seeing as it's my router/firewall appliance is always on.