@yakkoj Have you ever considered using #Netplan?

#ItJust works and also does all the nice stuff, like #VLAN's and #Bonding...

https://netplan.io/

Personally, I prefer putting #firewalling into the #Networking segment and put a #pfSense, #tnsr or #OPNsense in between it and the Interwebz.

But Netplan allows you to go precise and i.e. specify that no incoming connections are permitted on the Storage-LAN used for iSCSI traffic at MTU 9k and other stuff...