Hard disagree, I’d bifurcate my internal DNS in a hot second before I tried to fix this with static routes. Was internal services aren’t going anywhere in that DNS servers ain’t going anywhere The only time they can figure it should take effect is when it’s needed

Asking a noob to handle static routes is a double ungood situation.

Home gamer with a router that can handle reflection would be rare.

It’s one service that he’s hosting and in control of, and he’s also in control of that internal IP so it doesn’t have to change.

If anything I’d be worried that those VMs and applications in the VMs are getting regular updates. He’s more likely to get intruded through a zero day on one of those hacks than he is to see any serious issues through throwing a couple DNS records around.