This is absolutely possible as I do it myself however, executed entirely differently, my ASUS WRT Router with Merlin firmware handles the VPN server and it routes the IP range through my VPN provider (Proton), on the clients end their device see a Proton IP.

Didn’t have to mess with config files or anything, install the custom firmware and created a rule for the routing in the VPN Director.

Jellyfin thankfully lets you download content offline alternatively they just text me the IP and I whitelist it then blacklist it a week later, granted if I remember.

This really isn’t viable as WireGuard clients are just that, single device per client connection, what if someone started watching/listening content on their phone then all of sudden wanted to switch over to their TV or streaming device without having to go through a lot of hoops?

I opted to reverse proxy Jellyfin with Traefik however have fail2ban setup blocking every IP and only whitelisting the known users, added bonus of hiding Jellyfin’s default login form and required Keycloak for SSO.

https://floor796.com/