Different subnet. Firewall between the subnets and the internet. Only comm on allowed ports, etc. in fact, I’d keep relay somewhere in the ☁️🐶🐾🫡