@stephenw10 you described that limitation much better than I did. Thanks for clarifying for other viewers of the post.
Sorry for the delay...I'm trying to rethink how I've approached the network config. In the past, I know I knew how to do these things (hopefully the right way) but I've lost my mental notes. I think I'm going to greenfield this bad boy and cut over to ix1 for LAN, leaving eth1 as WAN, then drop the vLANs on ix1 as needed.
Time to hit the books and make sure I'm not missing details. As always, I really appreciate everything y'all do, both from a device standpoint and your support of the community.