That's not the way to do it. If anyone can break out of Plex they are on your local network. Besides, if you're going through all that networking hassle, you'r

That's not the way to do it. If anyone can break out of Plex they are on your local network. Besides, if you're going through all that networking hassle, you're better off doing things right. Get a real firewall like pfSense, then setup a separate network just for outside facing services. To access those services locally create firewall rules that allow traffic 1 way: from your trusted network to your outside facing network. While you're at it, consider making separate networks for IoT devices, and maybe even another for untrusted guest devices. You can use VLANs or physical interfaces if your firewall has enough ports.