Issue is assigning static IPs to devices like nest cameras and the dubiously branded vacuum cleaner, NAT alone should be enough to restrict connection even if the adapter its on is configured as lan then? Im a little in over my head as far as routing goes, wanting to self host some web server and I want to take as many precautions as necessary (maybe even overkill)