Server Version#: 4.53.0
Player Version#: 8.14.1.23548 (Android)
I have a pretty good solution to my Carrier Grade NAT (CGNAT) problem. Please take a look at my picture.

I have setup a mesh network using Tailscale between all components of my setup. I have an AWS Lightsail instance running Nginx Proxy Manager. The reverse proxy securely exposes my Plex server on my private LAN to my Plex instances on the internet. All seems to work fine.
I have all my media direct playable by all clients. However, if necessary, like for a browser, it can still transcode.
I would like to understand Direct play a little better, the documentation is great, but it doesn’t answer my question. When a player is found by Plex to be able to direct play some media, does the Plex server offer the player the direct link to the media, or is the Plex server always proxying the stream?
Since I pay for any network traffic overages in AWS, I am hoping I can coax the Plex server into allowing the Plex client to directly connect to the source media over my mesh VPN. This would bypass the AWS reverse proxy during media playback thus saving on my network traffic bill.
Any thoughts are welcome. 