DMZ & FreeBSD jail solution about freebsd-nextcloud-setup-hardened

[samuel-emrys]

So, I do address the usage of a DMZ on FreeNAS briefly, and dismiss it with reference to iXSystems statement that:

I believe all LAN accessible to the freenas host will be routable by a compromised jail

Configuring it so that this wouldn't be the case, would involve placing the jail on a different bridge associated with the DMZ NIC. This may have some benefit, but I'm not convinced in the context of the services being set up. In this case, the Nextcloud jail will have access to a signficant amount of sensitive information, and so in most users case, i would imagine that exposure to the remainder of the LAN will be cause for minimal additional risk.

With that said, I think that this would be beyond the scope of the current guide, as it's mostly a network configuration process rather than anything specific to Nextcloud. I might explore it with applications for other publicly facing services in another guide at some point in the future