a wireguard tunnel over a forced NordVPN tunnel will mean that all his traffic will flow all the way to the NordVPN node and all the way back for a LAN connection.
a properly configured wireguard tunnel is harder to configure than a tailscale network with a mullvad exit node. (I think)
a wireguard tunnel can only connect one device to the Jellyfin Server (or router if it supports it)
You can also add a second network interface to the computer that needs to access the jellyfin server over LAN.
If you are willing to swap to mullvad then you can also install tailscale. You can then choose to connect to your jellyfin server (over LAN) or (over tailscale-wireguard tunnel over LAN) while the rest of the traffic flows through mullvad.
What the f
Change the port.
Ok mr reviewer
Why don’t you tell us less about WV’s strategy a more about how the car is.
Does it spy on you? What kind of EULA will I need to agree to? Does it have car play/android auto? Does it have a 4G antenna to connect to VW servers even if I don’t enable the feature? Does it have an app? In what ways is VW going to try to get subscription money from me? How much does servicing cost? How much will a set of brake pads cost? Does VW support 3rd party repair shops? Does VW try to lockdown parts and forbid 3rd party repairs? Can it be remotely disabled? By me, by VW, by law enforcement? What happens when the battery needs replacing? What is the visibility like? If it horrible does it have obstable detection?
I solved a similar situation with a tailscale subnet router . a tailscale subnet router is a tailscale node that exposes the non-tailscale network to the tailscale network. This way I am able to access one of my routers (and its PBX) from all tailscale nodes. The android phone has only tailscale as a VPN. If i pay for mulvad I can have the rest of the traffic go over a mullvad node.
doesn’t really help you here though, unless you install protonVPN on the pi and add that as a tailscale exit node.