Veeam 12 Clean Room Firewall Connection

Found this that could be what I am looking for. 

Blocks rule for subnets 

I'd keep production and the clean room on separate VLANs/subnets, with OPNsense as the only routed path between them. The HP 2920 can handle switching, but don't let it route around the firewall.

Start with default deny between the networks. Check for an existing LAN-to-any pass rule. For NFSv4, one narrow exception might be a recovery host reaching the TrueNAS IP on TCP 2049. Place that rule above the block to the production subnet. Don't open the entire clean room subnet to reach storage. To turn access off, disable the pass rules and clear matching states so active connections close.

I'd pay particular attention to how TrueNAS connects. If it has an interface on each network, NFS traffic may bypass OPNsense entirely. Firewall rules wouldn't enforce isolation on that path. Separate NFS exports, host permissions and storage management help, but a NAS shared with production remains a dependency during a ransomware recovery.

Is TrueNAS connected directly to both networks, or will clean-room NFS access route through OPNsense? That changes how I'd build the rules.

​@eblack thans for your comments there will be two separate networks the clean room will have its own core firewall with restricted Internet from separate Internet ISP done some POC with Veeam 13 in Community mode over NFS backup from Veeam 12,did look over Wasabi but Veeam 13 is not licenced, but also got to understand if you connect to S3 bucket storage from your licencend Veeam 12 then it warns over that connect from a Veaam13 and will break backups on Production this can only then be used in real Cyber Attack restore from Wasabi same applies to TrueNAS scale with MinIO

The connection of TrueNAS is another issue to it self same would be for any cross connection used with OPNsense wanted with two interfaces with IP address to make point to point connections, bridge connection from my understanding does not offer that.

The import of backups on the NFS worked well but it gives option of live restore or restore to Hyper-V or ESX there is no option on this for Proxmox as we have instance of all three. 

The TrueNAS would connect via OPNsense but it could be physically unplugged from Production to Sire Clean Room but want to understand the implication of attack on Linux Systems. 

Then need to understand when Veeam 13 says use your own AV scan but does not provide details is it possible to cover a scan with Bitdefender do you place a command within the file system of VM as its local install, then this would be before VM is spun up, if the VM is started without network connection you could still run a scan in Bitdefender but would not have the latest update, Veeam have there own solution but it's another cost to low budget in the education sector. Not done research on this at present

I tried Bridge connection on from Production < > Clean but this does not work, as we have VLANs on both sides expect this to be the case.

The interface are 

Mgmt (LAN)

Int0 VLAN 10. CLEAN

Int1 VLAN 10. Production

Int bridge clean - production

Production TrueNAS NFS 192.168.10.20

Clean  Veeam 13 - 192.168.10. 30

Routing on both Prod - Clean 

Vlan10

IP 192.168.10.1 

Would routing be the issue on clean is there any way to pass traffic on Clean with more than one vlan what command would close of routing is this main route to ISP gateway to firewall

route 0.0.0.0  0.0.0. 0 192.168.2.1

Sorry for my lack of knowledge done my research as much as possible, it would be easy to just pull out the 10gb fibre from Production Link and insert into Clean. But wanted some form of control on firewall on Bridge connection. 

Should my Bridge be done with my Mgmt interface