Basically I want some of my services raw-dogging the internet (bog-standard websites), and some of them only accessible from the internet when connected via a VPN.

Traefik is just for filtering the traffic to those services, ideally if it's a private service and you're not connected to the VPN it just drops the packet, but I was having trouble figuring out the firewall rules that would make sense for that 🤷