Correct way to configure unRAID networking — management on native VLAN, multiple tagged VLANs, IPVLAN (single gateway / metric question)

Looking for a sanity check and a best-practice consensus on my Unraid network config. Everything works today, but I want to confirm I'm doing it the "right" way before I build more on top of it.

Environment

• Unraid: 7.3.1

• Router / firewall: OPNsense — handles all inter-VLAN routing, firewalling, and DHCP (Kea). Unraid host uses static IPs.

• Switch: Unifi — Unraid's uplink port is untagged/native on VLAN 30 (PVID 30) and tagged for VLANs 10 / 20 / 40 / 60.

• Uplink: [single NIC / bond — mode]

• Docker custom network type: ipvlan (Settings → Docker). Deliberately not macvlan, to avoid the macvlan call traces / host lockups.

• Bridging: enabled. VLANs: enabled.

Current config (Settings → Network Settings, eth0/bond0 → br0)

br0      VLAN 30  (untagged / native)   192.168.30.20  /24    GW 192.168.30.1   metric 20            -> management / host GUI
br0.10   VLAN 10  (tagged)              192.168.10.20  /24    GW 192.168.10.1   metric 4             -> current default egress
br0.20   VLAN 20  (tagged)              192.168.20.0   /24    GW 192.168.20.1   metric 5             -> Docker and VMs
br0.40   VLAN 40  (tagged)              192.168.40.0   /25    GW 192.168.40.1   metric 6             -> Docker and VMs
br0.60   VLAN 60  (tagged)              192.168.60.0   /24    GW 192.168.60.1   metric 7             -> Docker and VMs

Important detail: VLAN 30 is not defined as a tagged VLAN in Unraid. The management IP (192.168.30.20) lives directly on br0 as the untagged/native network. The lowest routing metric (i.e. the host's default route) currently sits on VLAN 10, not on the management VLAN.

Questions:

1. Single gateway / default route placement. Since OPNsense routes between all VLANs, should the host have exactly one gateway — and if so, where? Right now my default route egresses VLAN 10 (lowest metric) while management is on VLAN 30. Is it better practice to put the single gateway on the management VLAN (30) for predictable return traffic, or is "default route on a dedicated VLAN, management elsewhere" a perfectly normal pattern? Any real downside to having a gateway defined on more than one VLAN interface (asymmetric routing, etc.)?

2. Docker-only VLANs. VLANs 20 / 40 / 60 exist purely to place Docker containers. Do those interfaces need a host IP and/or gateway at all, or is it cleaner to set IPv4 assignment = None and just let the br0.X parent exist for container placement? Does leaving them gateway-less (or IP-less) cause any issues for container connectivity, given OPNsense is the gateway for each subnet?

3. Native / untagged management. Any reason to avoid running management on the untagged/native VLAN (30) and instead tag every VLAN (no native VLAN on the port)? Mostly thinking about VLAN-hopping / segmentation hygiene versus keeping it simple.

4. IPVLAN specifics. Confirming ipvlan is the right call here. With ipvlan (containers sharing the host MAC), what's the current recommended approach for host↔container reachability on the same parent interface — the "Host access to custom networks" shim — and are there routing quirks I should expect compared to macvlan?

5. Metric / routing behavior. Confirming my mental model: only interfaces that have a gateway defined participate in the host's default routing, and the lowest metric wins the default route. Is that correct, and is there any reason to set explicit metrics on interfaces that have no gateway?