I don't know, do they have to run on the same network as everything else? Maybe a first step is just to have an address range for these demonic things, which i

I don't know, do they have to run on the same network as everything else? Maybe a first step is just to have an address range for these demonic things, which isn't publicly routable (unless you deliberating NAT it). The "home network" range (steal back some of that loopback space!).