Please someone tell me if I'm wrong but from reading the wiki [0] everything in there screams "this has full access to the internet".

[0] https://en.wikipedia.org/wiki/Thread_(network_protocol)

Thread devices cannot access the internet without the cooperation of a gateway device. The topology is ultimately the same as Z-Wave with the devices communicating with a hub and the hub communicating with the internet. Thread is based on IEEE 802.15.4 just like Zigbee, but it uses IPv6 with extensions as the network protocol, for both a more powerful and flexible network protocol and more implementation commonality with existing network stacks.

That said, an explicit goal of Thread is to make the implementation of the gateway device easier and thus allow devices to communicate with a backing cloud service with less active participation of the hub... the hub is still "in the loop," but it doesn't need application-specific implementation for every device, it can just forward messages.

I haven't tested, but I'd hope HomePods acting as gateways would be able to toggle internet access. Apple made a whole thing about HomeKit wifi routers (there's like 1 on the market) where you can easily firewall any wifi homekit devices to within your network.

Enthusiast solution would be to use Home Assistant as your thread gateway to actually be in control of the connections:

https://community.home-assistant.io/t/home-assistant-skyconn...

For reference, the only HomeKit router listed on Apple's website is the "Linksys Velop AX4200 Mesh WiFi 6 System, Tri-Band"

https://www.apple.com/home-app/accessories/#section-routers

The last few Eero mesh routers have also supported HomeKit. That’s what I use.

From the Matter Spec:

> 2.3. Network Topology

> [...]

> This protocol may operate in the absence of globally routable IPv6 infrastructure. This requirement enables operation in a network disconnected or firewalled from the global Internet.

Key word there is MAY, not shall...

May implies it is up to the manufacture is internet (i.e globally routable IPv6 infrastructure) if required or not.

In the next sentence it says "requirement".

Confusingly, in legal terms "may" can also indicate a mandatory provision, depending on the context. https://www.law.cornell.edu/wex/may

Hm, yeah, it does say "cloud access". I hope they mean just the hub has access, and the devices don't rely on it.