Limit jail NIC access: one NIC to internal, one to external

[delovelady]

Running FreeNAS-11.2-U6. My configuration is that I have a server between the ISP and the rest of the internal network (including the FreeNAS system ("NAS1")); this server provides DNS, firewall services (beyond those provided by ISPs router) and other things. This configuration works great for me, for many years, with a couple of little nuisances when it comes to access from outside the network. Primarily these are PLEX and OWNCLOUD/NEXTCLOUD. At present NAS1's only connection is on the same internal switch that everything else shares. What I would like to do, is to attach NAS1 also to the external router, but allow access only to certain jails (not even to NAS1 itself; only jails within it). I've already set up routes in those jails, in anticipation of getting this working, so that part should be OK.

I did hook NAS1 up to the external router once, and the result was not what I wanted; I'd hoped it would still (magically) make the internal network primary, but it didn't work that way. It got all its DHCP services and configurations from the ISP router, and I had limited access within the local network; obviously not what I want.

The Network help at https://www.ixsystems.com/documentation/freenas/11.2-U6/network.html is OK but not detailed for this sort of thing. It is more of a "what's this do?" helper, rather than a "how do I do this?" guide.

I have not found other advice that addresses this sort of thing - including on these forums, hence the question. I would appreciate your guidance!

Again, to summarize: Would like external access to PLEX and to OWNCLOUD, but all other services off limits externally, while internal enjoys the full breadth of NAS1 services.

 

[dlavigne]

Were you able to find a solution for this?

 

[WilbertNL]

This is what you're looking to achieve, right?

Code:

Now:
<INTERNET>---[Modem/Router]---<Firewall>---[Switch]---<rest of network>
                                                |
                                                |-----<FreeNAS>

Wanted:
<INTERNET>---[Modem/Router]---<Firewall>---[Switch]---<rest of network>
                    |                           |
                    |----------<FreeNAS>--------|
                    Services/Jails        Services/Jails
                    Plex/OC/NC            All

Not quite sure if you would really want this due to some security risks...

.. I had limited access within the local network; obviously not what I want.

What connectivity did you manage to get?