DHCP / SSID Firewall Bug on v8.1.0?

I am running firmware v8.1.0 build 4941 on my Surf SOHO MK3, and I have encountered an issue that seems like it might be a bug.

I created a new SSID that is intended to only allow local network connections and block all WAN traffic to/from devices connected to that SSID. Here is what I configured:

My expectation was that if I selected “Lockdown - Block all except…” and then created a rule and selected “IP Network” and put in the IP address and mask of my local network, that would prevent any device connecting to the SSID in question from sending or receiving traffic to/from any IP address except an IP address in my local network.

It does appear to block WAN traffic (at least outbound), but it is hard to know for sure because when devices connect to that SSID they are not receiving an IP address–either via DHCP or via static assignment based on MAC address as configured in the SOHO. As a result, I’m also not able to reach any local IP addresses.

Is this a bug or is there something wrong with how I configured this?