Adding a screenshot for some clarification:
(while on Wireguard tunnel) UNRAID dashboard responds at 192.168.50.161/login
(while on Wireguard tunnel) jellyfin responds at 192.168.50.161:8096
(while on Wireguard tunnel) qbittorrent does NOT respond on 192.168.50.161:8080
This shows the NAT translation is working automagically when I connect as the Wireguard peer.
Furthermore, the Wireguard VPN running is assigning IPs 10.253.0.1/24, so the dashboard is also available at 10.253.0.1/login, jellyfin is available at 10.253.0.1 port 8096, but qbittorrent is NOT available at 10.253.0.1 port 8080.
So either it's not doing NAT because it doesnt know qBittorrent is there, or its the networking mode, or it could even be a different with the docker image, I suppose...