I installed the Apache Web Server on my computer and I use it for developing a website locally, when it is finished I will move it to a paid host. The protections implemented against incoming malicious connections are changing 'Listen 80' to 'Listen 127.0.0.1:80' in ports.conf, allowing only local connections (the part with 'Order Deny,Allow') in my Apache configuration file and also blocking incoming connections with the ufw firewall (well, probably too much than really needed but I do it the first time so better safe than sorry).
However, I wonder if the fact that I am connected to a commercial VPN used to encrypt my connection matter in this case. I use it because apart from working with my local server, I want to use the Internet in the meantime and be connected to that VPN.
I don't know if this is true but my concern is that normally if I wouldn't be connected to the VPN, I would certainly be reachable only under my computer's IP. And usually routers for regular clients are configured not to allow incoming connections (not sure about that). But when using the VPN, traffic is still encrypted when it is passed through the router and it is only decrypted on my computer. So that would bypass the normal configuration of the router to disallow incoming connections. Correct me if I'm wrong.
My questions are:
Is the fact that I'm connected to the VPN increasing the attack surface or decreasing it? Would it mean that I am reachable both under my computer's IP and the VPN server's IP? Or only the VPN server's IP? Does this impact security in some other way?
Will the measures I took to block malicious incoming connections (i.e. listening only on 127.0.0.1:80 in Apache, etc.) that I described in the first paragraph still work when connected to the VPN?
Bonus question: if my setup is insecure, what could I do better? My idea is that I could have my server inside a VM with network adapter disabled and do my VPN browsing outside of it in the host OS, would that be secure?