Right now I don't have a VLAN on ProxMox which I currently plan to set up when my L3 switch arrives in the mail. Then I can isolate my VMs and VPN. Some VMs need to site on the WAN, some go to static IPs from comcast, some need to go to a VLAN. Normally I use AlgoVPN- https://github.com/trailofbits/algo which is very simple wireguard VPN to set up but this time I might try https://tailscale.com/ which was suggested by a friend. It is free. I haven't decided. Whichever works best.