Jellyfin has a pile of security issues regarding unauthenticated enumeration of the media that’s shared. That’s probably not awesome on the public internet. 

I’d suggest setting up Tailscale. https://github.com/jellyfin/jellyfin/issues/5415

It’s pretty infrequent that roads go on after an exit to 150km uninterrupted highway or some other reason to behave this way.

These people are maddening.

They tend not to have a good command of the accelerator pedal’s capabilities to boot. There were a few opportunities for the problem driver to get going.

Thanks for sharing; I was unaware. Just closed off that network hole.

You have a firewall. It’s in your router, and it is what makes it so that you have to VPN into the server. Otherwise the server would be accessible. NAT is, effectively, a firewall.

Should you add another layer, perhaps an IPS or deny-listing? Maybe it’s a good idea.