You already have a bunch of NAT-level suggestions, so I wanted to mention there’s an alternative solution: split-horizon DNS, or simply split DNS. Basically, you run a DNS server in your LAN (like pi-hole) which resolves to the private IP, so resolving externally and internally give different results. This way packets don’t hit the router at all. You can also do a wildcard like *.something.lan to avoid having to add a record for every service, and only configure your reverse proxy.