Ok, didn’t think about “unlimited” actually being slower - thanks for the insight.

I’m running a pfSense f/w at the edge, so split horizon DNS and haproxy are already sorted… I’ll check out wireguard - should be straight forward

Thanks