[ck2]

routers could solve this for consumers with a checkbox for "intranet only"

99% of consumers won't know how to setup a firewall but could handle a checkbox

only problem I have is I can't seem to punch a hole for time sync and it won't use my local intranet time server

[ssl-3]

Time server can be specified with DHCP, if you want. Options 4 [deprecated, but that doesn't matter] and 42.

No idea if that helps with your particular devices; they are, of course, free to ignore those fields.