Worst case you could set up a router that denies all traffic by default, then work your way up to least privilege, and tunnel into the network with wireguard.