I found a few different AI blocklists, but I definitely can't just add these under unbound advanced external blocklists, because then I get everything resolving to 0.0.0.0. Is there a specific format I should be looking for? Are there any blocklists designed for opnSense that I should use?

EDIT: Ideally, I want to block all the LLM-created websites that show up when you search for anything. Not looking just to block the actual LLMs.

Hi everyone,

I've been running opnsense for a while now (mostly set and forget) and it has been a great addition to my network.

There is however one point I've never addressed and lately I've been thinking on doing it, but not sure how. Until now, my devices on my network they all are in the same default vlan, but with only 2 distinctions via firewall rules:

• can connect to the internet
• can only access local devices (so no internet. All iot sort of devices get this rule)

As expected, opnsense deals with dhcp and have also installed on the same machine adguard (with all expected rules to redirect all DNS traffic to adguard). All of my machines that are permanent in the network they have aliases and static ips.

I am aware this is not a great setup, and this is why I wanted to implement vlans to make sure if a rogue device is installed at first creates no harm to the network at large (meaning: devices by default fall into a vlan without access to the internet at least, more drastic measure is not allow access to anything besides the router). Eventually, a vlan where devices can only go to the internet can be added, and of course, a vlan that just has all the expected access to the home devices.

I did some research on this and there is information on how to do vlans and such but sometimes the explanation goes a bit over my head (or the explanations don't cover some important details). So my broad question to all of this is:

• do you guys know anyone that explains vlans on an understandable manner inside opnsense? Usually video form is best, but articles can be useful too
• does this setup with 3 vlans makes sense in the 1st place?

If someone has input on how this can be best done I would like to know as well, since I can be approaching this in a too complex manner.

Hi! I'm currently trying to set up my network as seen in the image. USER VLAN has the tag 11, IOT VLAN has the tag 13 and GUEST VLAN has the tag 14. These are tagged by an Omada AP and Omada Switch on individual ports.

So far I have:

• Assigned igc1 (LAN) and igc2 (Wifi) and enabled them (no IP configured).

• Created a Bridge between igc1 and igc2 so they are in the same subnet, which I think of as some sort of management subnet.

• Configured a static IP (192.168.10.1/24) on this Bridge and enabled DHCP. All devices are reachable here and it is also possible to reach the internet from the Omada devices.

• Created VLANs vlan01.11, vlan01.13, vlan01.14 with their parent being igc1 (Omada Switch).

• Created VLANs vlan02.11, vlan02.13, vlan02.14 with their parent being igc2 (Omada AP)

• Assigned all of them and enabled them (no IP configured)

• Created a Bridge between each pair (vlan01.11 + vlan02.11 etc.)

Now my problem is that seemingly no matter what I do some devices on the VLANs cannot reach the internet because they cannot reach their Gateway.

I tried:

• Configuring a static IP to the VLAN Bridge (192.168.11.1 for USER VLAN) and enabling DHCP on it with the correct subnet. Doing so not a single device was able to reach the Gateway, but they were able to talk to each other. DHCP worked this way for both endpoints.
• Instead of configuring a static IP to the VLAN Bridge I configured it right on the vlan02.11 interface and enabled DHCP there. Doing so only the devices on the wifi are able to reach the Gateway but the devices connected via the Switch cannot. In addition DHCP does also not work for devices on the Switch.

Does anyone here maybe have a hint on what I am doing wrong?

Edit: I also tried:

• Combinations of net.link.bridge.pfil_member and net.link.bridge.pfil_bridge but that didnt work either.
• Removing the bridge and using only the vlans but with the same subnet

What hardware is nice for opnsense?
From AliExpress?