Better yet, use docker so the torrent client doesn’t even know other network interfaces exist

Do what you can to make this the place you want to be.

Pretty much, strange in the self-hosted community to have stuff like that happen.

Wireguard is super quick and easy to setup and use, I’d highly recommend to do that now. I don’t understand the recent obsession with Tailscale apart from bypassing cgNAT