When you say “when accessed from outside my home network”, what kind of access is that? Port forward? VPN?

Accessing via 443 forwarding to my reverse proxy from the internet. My dad will hit my Jellyfin server from his house, and I can hit that server from mobile networks when I’m not on wi-fi.

Is 192.168.1.1 your router?

Yes. It’s also .10.1 on the 10 VLAN.

What’s your LAN netmask?

255.255.255.0 on both VLANs

NPM listens on 192.168.10.201 ports and Jellyfin/Komga on 192.168.10.202 ports?

Correct.

A connection from the outside comes through the router, gets forwarded to 192.168.10.201:443, the proxy sends it to 192.168.10.202:8096, and it shows up in the Jellyfin logs as coming from 192.168.65.1?

Correct. Jellyfin is actually listening on a different, auto generated, arbitrary port that I just stuck with, but other than that, you got it.

I did check every IP address I could find anywhere on my network and couldn’t find the 192.168.65.X anywhere, but @anamethatisnt@sopuli.xyz here in this thread seems to have identified this as some NAT setting built in to Docker. Running on default settings for network, because I had no idea why I would want to modify any of those settings, they are running as bridge networks.