[henriks]

An alternative to worrying about two ethernet ports on the Pi itself is getting a managed switch with port tagging, and just setting up multiple VLANs on the Pi itself. I'm doing that myself with another small single-port board, works quite nicely.

[m463]

The effort of learning how to set up and maintain vlans is WELL worth it.

for example, many of my machines are on a private vlan that cannot get out (except through a proxy). This is one of the most effective ways of managing your devices since this means by default you will have to opt-in to talk to the internet.

[Nux]

Indeed that's another way of doing it, quite elegant, too.