Preventing TrueNAS SCALE Apps from Accessing Bridged VLAN Interfaces

Apps and Virtualization
1

I’m running TrueNAS SCALE 25.04 and I’ve hit an unexpected networking issue.

My network setup in SCALE:

  • br0 (LAN, 10.4.0.0/24) – used by the host, Apps, and VMs.
  • br50 (VLAN50, 10.50.0.0/24) – created so that VMs and the TrueNAS host itself can access VLAN50 directly.

Important detail:
br50 was only intended for VMs and the host. Apps/containers should not be able to access VLAN50.

The problem:
Despite firewall rules on pfSense to isolate VLAN50, I’ve discovered that Apps can still reach VLAN50 devices directly. For example, from inside a container:

traceroute 10.50.0.21

Result:

 1  172.16.42.1 (docker bridge)
 2  10.50.0.21

So the traffic goes straight from the Docker network into VLAN50 (via br50), bypassing pfSense completely.

My questions:

  • Is this expected behaviour when a VLAN bridge like br50 exists on the host?
  • Is there a way to configure SCALE so that Apps cannot use br50 by default, while still leaving it available for VMs and the host?
  • If not, is the only option to block this locally with iptables/nftables?

My goal is to ensure that only the host + VMs can use br50, and that Apps are restricted to LAN (br0) so all cross-VLAN traffic has to pass through pfSense (where the firewall rules apply).