FYI I’ve been doing this for 3-4 years. It’s excellent and trouble free. My favorite part is the Google Cloud Firewall. Ours is locked way down. When we’re in the field using the 3CX mobile app and we get somewhere where the phone can’t log in, we find out our IPV4 address on the phone, then open that /16 block to the switch. Yeah that means some mobile customers in that area can see the switch but it beats the hell out of exposing it to the world!! You could tighten it to /24 blocks but sometimes you will jump from one bock to another, or your iPad may be in one and the iPhone in another.