I Am no security expert however I Only have one port forwarded on my router and the port points to swag proxy manager. Then I am using cloudflare DNS with proxy enabled for all my sub domains. Cloudflare is nice IMO because you can block and allow access to specific parts of the world. For me Cloudflare configured to only allow connections from within the United States, all others will be blocked. Also it allows you to block connections to specific URLs, I have /admin blocked (used by vaultwarden) so that can only be manged locally. The rules you can configure with Cloudflare are almost limitless. Its obviously not an all in one solution to security, but it does its share of work.
