you can change MBG to be single nic by rerunning the setup my server and de-selecting the WAN interface
then you can open ports on MBG public ip on firewall and allow them to teh Internal Address of the MBG.
MBG with 2 interfaces is only supported when one of them has a public IP
if its lan mode or in DMZ it MUST have single network interface Eth0
its its got a WAN interface (Eth1 ) the WAN MUST be direct connected and have a public IP assigned
"got a WAN interface (Eth1 ) the WAN MUST be direct connected and have a public IP assigned"
not true.. the WAN connection can be in a private network (like a DMZ) without a direct public ip assigned to the interface. You do require a public ip assigned to MBG, but that can be owned by the f/w (routing all traffic to MBG). In MBG, you select a "custom" network profile and populate the "setside streaming address" to be the public (and the "icpside" one to be the lan address).
This is how we do a lot of our deployments. The public IP is attached to the customers firewall and they allow the ports required. They like to have control over the network.
Azure/AWS deployments also work like this. The MBG WAN NIC has a private IP and the public IP is associated to that. It also has Network Security Group rules that restrict ports before it gets to the MBG. This is all provided in the templates supplied by Mitel.