How does Plex (web or player) discover Nerby server?

I have an unusual problem. I have a VPN setup between me and my friend via 2x Opnsense firewalls. My friend is also running a plex server. The problem is that I don’t want Plex to be routed via VPN, but somehow it is. Plex media server discovers it somehow (even though the discovery is turned off in the settings). We have 2 completely different subnets: 192.168.0.0/24 and 10.10.10.0/24

My question is, how does the discovery work. I want Plex to go directly over the internet bypasssing VPN.

AFAIK, Player goes to:
https://plex.tv/api/resources?X-Plex-Token=YOUR-TOKEN

or

https://plex.tv/api/servers?X-Plex-Token=YOUR-TOKEN

It then compares IP-Net of the resource in question

To get YOUR-TOKENlook here: https://support.plex.tv/articles/204059436-finding-an-authentication-token-x-plex-token/

OK, that makes sense. I had to block 32400 for the ipsec tunnel in the firewall to force traffic over the internet instead of VPN.
Thank you