VPN for router decision.

Hi homelab engineers!

I have multiple physical servers in a proxmox cluster.

I use PFSense hosted on a VM for my main firewall/router setup.

I’m considering adding a VPN to PFSense to protect everything on my network. I am also considering adding a Tailscale connection to a setup I have in another location.

I have been using ExpressVPN for a few years on my phone and laptop while travelling but I am not sure this is the right choice. As I understand it, ExpressVPN only offers downloadable configurations for OpenVPN, not Wireguard which is faster and preferred in my case (although I am open to discussion on this).

Another option is NordVPN. I’ve heard NordVPN also has a mesh system that will connect all NordVPN endpoints together in a virtual LAN over the Internet eliminating the need for Tailscale.

There’s a few issues I’m tracking:

• Some of my external facing servers will likely not work over the VPN with some special configs, I was going to exclude their traffic from VPN.
• some public websites won’t work over a VPN, I would also exclude these from using the VPN.
• I have heard that using a VPN while some traffic from the same network bypasses the VPN creates a vulnerability and it may as well not use a VPN at all, but I don’t know how true this is.

So… What do you all think? What’s your opinions? Is there something else I could do that I haven’t mentioned?