I think I've been focused on this for too long... losing my common sense and objectivity. You are of course 100% correct.
I have a few rules to allow the lxc to get to the router and to the guest zone and I think it's function:
Deep and sincere THANK YOU for all the time you spent with me on this. Once my head clears, I think I might write-up this for others.