ADR 0138's reach is internal, public or both. ace's LAN devices (an IoT switch on mosquitto, unifi access points, plex clients) are none of them; the only reach that admits them is public, which states the wrong thing and opens the port to the internet on any machine with a public address.