@wolf480pl @benis tbh i find the policy fine. It prevents human error from ever accidentally letting the guest network communicate with something internal that they shouldn't be able to. And usually it can be solved with something simple like "just buy a separate one for the guest network". However printers are the exception, we just plain can't afford to buy 50 new MFPs for the guest network and/or don't want to pay that much.

But it presents a number of technical difficulties since most things support either pull or push configurations, rarely both.

For example, anything that talks via MQTT pretty much automatically meets the requirement.