First pair correct.
Second pair should be like the first one, with UDP.
Third pair correct.
If you set something in run comm., it will “overwrite” the setting in config.
No need to set it in both places. And from my expirience with Docker, is better to set everything in run comm., and never touch config.
Check my settings and put all ports in run comm.
I will update it with some new parameters, but those are ok too.
https://forum.storj.io/t/my-docker-run-commands-for-multinodes-on-synology-nas/22034
As a little sugestion, instead of trying and maybe paying all the VPN/VPS providers out there, maybe you can ask your friends/employer to let you use a part of their internet connection, through Wireguard.
Offer to buy them a new router (a model that supports Wireguard server), set a Wireguard server there without access to internal network, just to let them know you can’t access their LAN machines, and you are good to go. Don’t forget to set port forward of course, and reserve yourself a fixed LAN IP.