Intranet/LAN only devices
There's currently no way to forcefully set a device as being able to only communicate on the LAN only. For instance, I don't want my networked printer to be able to call out to the internet. I also don't want my IP Cameras to call out to the internet.
In theory we could get around that by setting a forever scheduled internet pause on a device, but that ends up cutting off LAN access as well as internet access. Which is another problem... (Blocking my sons computer from the internet so he's forced to do homework, shouldn't also block him from being able to print his book report on our WiFi printer.)
I guess what I'm getting at here is that some fine grain control would be great, for devices that I want to securely lock down to my own private LAN. I also think saying something is being blocked from the internet shouldn't also disqualify it from communicating with LAN devices.