Oo so you’re wanting to set up a VPN to cover your tracks with usage of those apps and you’re wondering the best place to set up the client, either at the VM level or network level? Network level is going to be more robust but will require additional configuration to allow non-VPN traffic to work correctly, etc. If TrueNAS is deprecated, then I suggest you don’t put it there. The VM approach could work if configured correctly.