Just wanted to mention I had a similar issue and setting up duckdns with the dns-01 challenge worked perfectly. I tied my duckdns to the exit the VPN's IPv4, forwarded a port, then used certbot, (a venv to allow pip on a raspberry pi), 'pip install certbot_dns_duckdns' and the following:
certbot certonly --non-interactive --agree-tos --preferred-challenges dns --authenticator dns-duckdns --dns-duckdns-credentials YOUR-TOKEN-UUID --dns-duckdns-propagation-seconds 60 -d yourdomain.duckdns.org --key-type ecdsa --elliptic-curve secp384r1
Thanks for your post, definitely wouldn't have figured this out otherwise!