That was it. Guest network hands out the router as DNS fine, but my sketch was using a hardcoded NTP IP that a firewall blocked, so the clock never set and TLS failed. Switched it to pool.ntp.org and the sensor came back. All five are on the guest network now, isolation off, and the work laptop can’t see them.
Didn’t touch the port forwarding, Kevin, thanks anyway.
Ask me about 4–20 mA.

