No, it’s inside the network. Once I’m inside my network via the VPN, the proxy server routes to the service I want based on the subdomain instead of using the IP and port as the address.

This can also be useful if, instead of going the VPN route, and you choose to go the CDN tunnel (for example, Cloudflare) way. I actually started with a tunnel via Cloudflare, but after some digging, I don’t trust them anymore. Having a tunnel allows you to close all ports coming into your network, but at the expense of having to trust the tunnel provider, and I don’t trust many companies out there.