So just to confirm, it's the cameras/PoE switch on NIC2 that shouldn't have ANY direct internet access, not the BlueIris machine that the cams feed in to? i.e. as per your picture, only the cams are isolated, the BlueIris machine itself is still fully connected to the internet via NIC1? Sorry...