It’s gone now. I should have grabbed a copy when that NoClip documentary dropped a few years ago.

If anyone knows of a mirror, I’d love a link.

This is the way. Layer 3 separation for services you wish to access outside of the home network and the rest of your stuff, with a VPN endpoint exposed for remote access.

It may be overkill, but I have several VLANs for specific traffic:

• DMZ - for Wireguard (and if I ever want to stand up a Honeypot)
• Services - *arr stack, some Kubes things for remote development
• IoT - any smart things like thermostat, home assistant, etc
• Trusted - primary at home network for laptops, HTPCs, etc

There are two new additions: a ext-vpn VLAN and a egress-vpn VLAN. I spun up a VM that’s dual homed running its own Wireguard/OpenVPN client on the egress side, serving DHCP on the ext-vpn side. The latter has its own wireless ssid so that anyone who connects to it is automatically on a VPN into a non-US country.