That should be the solution for everything but unfortunately I'm dealing with containers that advertise their IP via Bonjour (or whatever the new thing is). But since they run in a container they get their 172.19.0.0/24 IP, so they broadcast the wrong one.

Then there is the issue of certain devices only accepting things like HomeKit via a barcode and/or discovery, and not via IP addresses.

If I could just do IP addresses it would be so much more easy to cordon off things. IPs can talk across networks with ease, no hacks required, but at least I control it.

Inside of a network it's very hard to selectively allow / deny traffic.