I plan to keep mine in an egress only state behind NAT (It can connect somewhere, but it's not reachable). Maybe, maybe I'll include it in my VPN setup.

Yeah, that was the state mine was in, it didn't save me.