

STUN/TURN is literally designed to bypass network boundaries. Its necessity comes from the evil of NAT and allowing RFC1918 IP addresses behind firewalls to poke holes so that direct P2P connections can be established for VOIP.
By virtue of being technology designed to step around boundaries, you should be weary of controls around this. STUN can be used to relay from the external STUN record to other servers within the same broadcast domain. We’ll add some controls here to limit this, but it would behoove you to place this server in an isolated DMZ without connectivity to other, potentially privileged, internal hosts. Never forget network segmentation.```
Would a VLAN be enough?
I’m on the same plan, I do plan to self host it though as a backup only.