My use case is simple. I have five disparate IP subnets whose firewall must NOW have to ascertain that ONLY a certain subnet can access this unbinded netdev …

My use case is simple. I have five disparate IP subnets whose firewall must NOW have to ascertain that ONLY a certain subnet can access this unbinded netdev … in case the NGINX (or any daemon) starts to sniff unwarranted IP subnet traffic. And yes, you can bind to a dynamic IP assigned netdev. And yes , I’ve had to replace NGINX with a web server that can do a netdev bind.