More technically there’s two ways to move data between two separate services. You can either pull or push the data.

Assume for both scenarios that the client is your phone and the server is some machine in the cloud.

With pulls the client calls an API and the server returns a response. Generally the www works this way. You ask a server for a wab page and you effectively pull the source down to your browser.

Pushes work the opposite, in that a server has data for the client and needs to push or otherwise give it to you. Pulls are relatively strait forward because every server has a well known name (the domain name and url). But your phone’s IP address changes constantly. So how does a server know how to contact your device? There’s generally two ways:

1. Your device can poll (make repeated pulls to a server checking for new data)
2. Or you can register some identifier and your IP address with some central server every time it changes. And then the server can essentially call a URL on your device directly. This is essentially what Google and Apple are doing as it doesn’t waste CPU resources and your battery.

You could in theory implement either of these yourself but because of the way the OSes work on both Android and iOS there’s no guarantee that you can keep a process running in the background forever. As the OS can kill your process if the OS needs more free ram, etc … The built in notification APIs are exempt from this because they are part of the OS.

If you’re worried about your IoT devices on your LAN the problem isn’t necessarily that they can access WAN but rather that there’s a security vulnerability and that they can be accessed by the WAN. Once a device is compromised and attacker can then use it as a “beachhead” to access other devices on your network.

So for example, with my setup every IoT device is on a separate VLAN (the guest network acts similarly) which can’t get access to WAN, can’t be accessed from the WAN and can’t initiate any network calls to any other VLAN. Now my primary VLAN can talk to my IoT VLAN, and IoT can talk back, it just can’t start the communication.

This does pose a problem for TVs though that need to talk to Jellyfin as hinted at in the original post. So what you could do is create a specific firewall rule that allows the TVs to at least initiate communication to Jellyfin but not any other device on your primary VLAN. This will probably require a more sophisticated router though than most of the consumer ones out there. Just be mindful that if n IoT device is compromised they can then try to attack the jellyfin server to jump to your other VLAN and then the rest of your network.

Just wanted to add… After reading your initial post I did some more digging on adding tracking headers, etc… especially by T-Mobile.

While it’s definitely a thing, it only applies to HTTP traffic. Even HTTPS blocks their ability to add those headers. So any traffic that’s using any other protocol (DNS, email, ssh, or just gaming, etc…) would be safe from your ISP from at least trying to add these tracking headers.

Yes but while the service is targeted for home use there still is remote work which generally requires a VPN back to the company network. They wouldn’t be able to block this. Now sure they might be more inclined to block Mullvad but they’d impact too many businesses by blocking wireguard as a whole.

And assuming they did block Mullvad but not wireguard… Just rent a VPS and install a wireguard server and client there to bridge back to Mullvad.

I know this doesn’t help much but I use T-Mobile cell towers with an always on VPN with no issue. But I don’t see why they’d block Mullvad. (I’d be more concerned that they’d block them than wireguard in general). But there’s completely legitimate reasons to use both so I don’t see them really bothering to block either.