Yeah, I’m starting to think that a tunnel at the router level with family is a preferred approach. I dread the setup time, but it sure lowers the attack surface.