Hmm, I think it would not necessarily expose the rest of the network, though: if the router supports it, I would use a tagged vlan (let's say wan.42) as the ups

Hmm, I think it would not necessarily expose the rest of the network, though: if the router supports it, I would use a tagged vlan (let's say wan.42) as the upstream connection, and wan.10 as a lan port, part of the switched interfaces. On the switch side, I'd have put the SFP connector inside VLAN 42, untagged, and put every other port in VLAN 10, untagged. There are probably a couple other ways to achieve this, and ISPs sometimes use tagged VLANs as well. But I think that could work (I have little experience with VLANs, so I might be wrong, feel free to point it out to me). On the other hand, if I had gigabit fiber, a single cable would halve my bandwidth. And I'd pick the multiple cable option over the other as long as I can afford it (enough ports)! Thanks for pointing out the layer 2 "noise". I wonder if my switch wouldn't support bridging together two ports, I think it runs Linux...