Yep. That’s why a lone but shadow port is taken from the high-end of ports … just for SSH (on the inside). Two interfaces. No bridge. Raw Netdev.

Almost like an overglorified but managed hub.

If you like your MAC, you get to keep your MAC.