I tried all three of these, then swapped to just the first since that seemed most likely to work, but it still wasn't.

https://codeberg.org/just_a_husk/uBlockOrigin-AI-Blocklist/src/branch/main/list_uBlacklist.txt

https://github.com/Stevoisiak/Stevos-AI-Blocklist/blob/main/GenAI-Blocklist.txt

https://raw.githubusercontent.com/NotaInutilis/Super-SEO-Spam-Suppressor/refs/heads/main/unbound.txt

which list file did you use? there are multiple formats, some of which are probably not supported correctly by opnsense

Literally every request started resolving to 0.0.0.0. Facebook, Google, DuckDuckGo..

I don't use opnsense and just found this through my "All" feed, but I don't understand the problem with resolving to 0.0.0.0, as that seems to be the point of the blocklist?

Yes that sounds logical. Opnsense documentation I feel is good but for people that sort of know already what they need and want a full set of options. For someone who is somewhat clueless becomes less clear.

I will try to have some time on this. Hopefully I can come to answers eventually

If I'm understanding your network description that mostly makes sense. I would do it slightly differently though.

1. Your devices get more or less free access to each other and the internet

2. Basically a guest network. Free internet access but no (or very limited) access to local devices.

3. IOT network with local access but no internet.

Not aware of any good tutorials, but you can look at the OPNSense firewall rules as a starting point. You'll need to add and/or change some anyway for your new VLANs.

I have unifi set up with three matching SSIDs tagged to the respective VLANs.

Congrats if it is working, as far as I know when you do a bridging you shouldn't have an ip, because both ports are seen as a same Mac interface...

Something is not working as I think it should. But if it is working nothing else to discuss

Hmm I think I this does not work in case you meant to put the bridge as the parent of the VLANs, OPNsense does not allow this:

now, define 3 vlan with the vlan tags you defined in the switch + ap, you need to say that the port they are received is the bridged port

However I think I found another solution that works exactly as I want but it is very weird so be warned:

• Created vlan01.11 and vlan02.11 on igc1 and igc2 respectively, assigned them, enabled them and gave each a static ipv4 (192.168.11.1 and 192.168.11.2)
• Created a bridge with both VLANs as members, did NOT assign and enable this (when I do the setup breaks (?!))
• Use KEA DHCP instead of ISC:
  • In settings listen on both VLAN interfaces
  • In subnets create the subnet with subnet=192.168.11.1/24 and a pool of 192.168.11.21-192.168.11.254, uncheck "Match Client-id" and "Auto collect option data" and set Routers, DNS and NTP Servers to 192.168.11.1 and 192.168.11.2

This way KEA will give out IP addresses on all interfaces with a static IP in the defined subnet. Make sure to disable ISC DHCP as it otherwise caused issues with KEA and somehow also Unbound (I also enabled "Register ISC DHCP4 Leases" in Unbounds settings because I had weird issues with SERVFAIL there).

I repeated this process for the vlan0x.13 and vlan0x.14. Now internet access works on all VLAN interfaces, aswell as the normal interfaces and I can still define Rules for each VLAN.

What I don't get about this is why I cannot assign or enable the bridge interface... but I guess it works soo I'm happy. Thank you for your suggestion though!

Yes, thanks

The setup seems possible with the exception of all of them under the same subnet. I really discourage it because I am not sure how opnsense and the DHCP sever will work with firewall rules based on ports and not subnetworks. If you accept this deviations what you need to do is:

• take both ETH ports in the opnsense make a bridge between them
• now, define 3 vlan with the vlan tags you defined in the switch + ap, you need to say that the port they are received is the bridged port
• now define 3 different interfaces (1 per vlan definition)
• configure every interface with a static ipv4 ip and a different dhcp server, they should have different networks
• now in the firewall configure how 3 interfaces should communicate to each other

As. Summary the steps should be

Briged port -> vlan ether ports -> interface definition -> ipv4 + dhcp configuration -> firewall definition.

For ipv6 it is almost the same

Mainly I want to have separate USER, IOT and GUEST VLANs. So for example I don't want guests to be able to access IoT devices.

The AP and Switch tag these VLANs based on SSID and Port a device is connected to, so OPNsense receives tagged traffic that I can put rules on. I could probably just connect the AP to the Switch and be fine, but the Switch is 1Gb and the AP has a 2.5Gb port so I would like to keep both the switch and the AP connected to OPNsense directly.

Having the switch and AP on their own subnet is not really a requirement, but I guess it would be nice to also be able to control who can access their webinterfaces.

So really I just want to have:

• AP connected to one port on the firewall
• Switch connected to another port on the firewall
• Both AP and switch tag frames and pass them to OPNsense so I can apply rules.
• Devices on vlan01.11 can talk to devices on vlan02.11 and so on
• A single DHCP provides IPs to all devices connected to both the Switch and AP

Does that make it more clear?

Almost everything works as long as the Ethernet chipset are Intel.

For the wifi is a bit (or a lot) more complicated, you will need to research.

How many ports, ram or cores is something that depends of your use case and you didn't specify

But if you want a small guidance I used a second hand sophos machine for ebay, and without idp/ips is sitting very comfortably on my home network

There is something I don't fully grasp.

The vlan separation is because you want a total isolation between the vlans (including different subnets) or just you want an isolation to the ap/switch level?

Depends of what you want the configuration is different and the config you posted seems to be mixed to me

Depends a bit what you want to do with it. Replace your router? Just apply FW rules in your LAN? Intrusion Prevention/Detection?

Make sure the Network Interfaces are performance under BSD.

Check this if you haven't already: https://docs.opnsense.org/manual/hardware.html

Everything on Amazon is from the same place, just with a markup for you local burgeosee lifestyle

Don't buy shit from AliExpress.