Add a section about running behind VPN

Is this really the best solution? the NAT port forwarding was removed as its unreliable :/