I went through it with a magnifying glass to make sure it didn't select anything.
In addition, I set up the IP stuff manually on the printer to ensure there was no gateway... can't get out without a gateway.
At some point, though, I noticed that "something" [0] still managed to "get out".
After running some packet captures, it became clear what was going on. Although the device was using the network settings that I had manually configured, I had not specified a default gateway. The device decided it would use DHCP to discover the default gateway for the network and began automatically using it so it could get out to the Internet.
Since then, I've started specifying a default gateway for any devices that I don't want to get out. I give 'em an IP address that isn't in use on the network and, fortunately, I haven't ran into any other instances of crap like this happening.
[0]: I really wish I could remember what device this was but it's been a long time ago and I really have no idea, sorry.
They're dirt cheap and have been for the better part of a decade. If you're looking to upgrade, cost isn't a reason not to.
• http://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_...
• https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...
My printer is in a VLAN which has no route out over the Internet. (The second link there uses VLANs).
It does not protect you from compromised, malicous (IoT) devices. Think about a network printer doing ARP spoofing and MiTM-attacking your VoIP phone or IP cam. E.g. googeling immediately turns up vulnerabilities like this [1] one. A properly configured VLAN setup can help to prevent or limit this threat.
[1] https://www.scmagazine.com/home/network-security/hp-officeje...