Does Orbi Support routing out NAT interface networks forwarded from down stream routers?

Thanks for the hypothesis thought.  So looking at the lan.pcap with a ip.src==192.168.111.2 I see a ton of packets with public destinations address.  Essentially my lab environment screaming to get out.  So does that mean it’s not getting blacked? 

Great question; why.  Before I started experimenting w/ Sophos I had a pfSence router as my 1 any only router managing all my networks and masquerading at the edge.  Due to my desire to play with tech toys I recently caused a site wide outage resulting  in excessive banging on my home office door by a bunch of kids who couldn’t get to their game servers & a wife who’s favorite video streaming service discontinue to function.  This setup you so gracefully commented on is my idea to hang my entire lab off the house backbone LAN.  Lab including a router bgp’ing into a NSX-T infrastructure.  My real experimental goal.

The results of your capture suggestion has me scratching my head a bit.  When I look on the wan.pcap w/ a filter ip.dst==8.8.8.8 (google DNS server) all I see is DNS queries not any ICMP traffic which is what my test case should be generating….

Maybe my idea is pushing Orbi’s original design.  I just figured it was a fairly simple ask.