Moves WireGuard off the management computer and onto OPNsense so any
device can VPN home without touching the management PC. Each peer is
restricted to only the VLANs you select (e.g. phone gets VLAN 10 only,
laptop gets VLAN 10 + 20). Private keys are generated on the mgmt PC
and never sent to OPNsense — only the public key is registered.
Backend (switch_backend.py):
- /api/opnsense/wireguard/status — check plugin, server, peers
- /api/opnsense/wireguard/setup-server — create wg1 on OPNsense via API
- DELETE /api/opnsense/wireguard/server — tear down server
- /api/opnsense/wireguard/add-peer — generate keypair, register peer,
link to server, return .conf
- DELETE /api/opnsense/wireguard/peer/{uuid} — revoke peer
- /api/opnsense/wireguard/peer-config/{name} — fetch saved .conf
Frontend (ers5952-manager.jsx):
- New OPNsenseWGSection component added to VPN tab below local WireGuard
- Progressive UI: not configured → plugin missing → server setup →
peer management (VLAN checkboxes) → QR/.conf download
- Firewall rules guidance panel auto-generated from active peers showing
exactly which OPNsense rules to add per VLAN
- vlans prop threaded through to WireGuardTab so VLAN names/colors
appear on peer badges and in the VLAN selector
https://claude.ai/code/session_01JR2EMK7rwrZJowpstcaxQ6
- Backend: _get_relay_status() reads current ip helper-address per VLAN
- Backend: _build_relay_cmds() generates ERS 5952 relay CLI commands
- Backend: /api/dhcp/relay/status and /api/dhcp/relay/configure endpoints
- Backend: dhcp_overview now includes relay status in response
- Frontend: VLAN_MAP + VlanBadge + vlanFromIp() helpers for consistent labelling
- Frontend: RelayPanel shows per-VLAN relay status grid with push button;
VLAN 99 always shown as locked/local, VLANs 10/20/30/40/50 show live
relay target and purpose note
- Frontend: Reservations table gains VLAN column and inline purpose note
(from descr/notes or VLAN_MAP fallback)
VLAN 99 is excluded from relay at both backend and UI level — it is the
switch management / OPNsense recovery path.
https://claude.ai/code/session_01JR2EMK7rwrZJowpstcaxQ6
- setup_ctrld() now asks for each VLAN's actual subnet (was hardcoded
as 192.168.{id}.0/24, wrong for any non-default addressing)
- Asks for local domain suffix (default: lan) with explanation of what
it is and where to find it in OPNsense
- Asks for local resolver address (default: 127.0.0.1:5353) with a
full plain-English explanation of WHY Unbound must move off port 53,
why both .lan and .local rules are needed, and what breaks without them
- _ctrld_opnsense_setup() now walks through the Unbound port change
step-by-step with exact OPNsense UI paths, pausing for confirmation
at each stage before proceeding
- All three install paths (_local, _opnsense, _manual) now pass
local_domain and local_resolver through to _build_toml()
- Intro text rewritten for someone unfamiliar with DNS filtering,
VLANs, or Resolver IDs — explains what each thing is before asking
https://claude.ai/code/session_01JR2EMK7rwrZJowpstcaxQ6
Features added:
- Port 53 conflict resolution: auto-detect/fix systemd-resolved stub listener
on Linux; instructions for OPNsense Unbound (ctrld auto-terminates it)
- DNS enforcement ACLs: generate ERS 5952 ACL commands that permit DNS only
to ctrld IP and block all other port 53/853 traffic per VLAN
- Inter-VLAN routing ACL templates: Staff, IoT, Guest, Camera profiles with
live preview and parameter inputs (ctrld IP, NVR IP, subnet)
- Local hostname resolution: dnsmasq Docker service for .lan split-horizon DNS;
manage hostname→IP mappings via UI; generates dnsmasq.conf and ctrld.toml
upstream.local block
- Fix ctrld.toml format: correct [listener.0], [network.N], [upstream.N] table
notation (was using wrong [[array]] notation); matches official docs format
- Backend docstrings: added docstrings to all previously undocumented functions
- README: new sections for port 53 conflict resolution, DNS enforcement ACLs,
ACL templates, and local hostname resolution (dnsmasq)
- Fix Python 3.11 f-string syntax errors in Avaya_5952_setup.py (backslash
in f-string expressions, same-type quote in dict access); embed now succeeds
https://claude.ai/code/session_01JR2EMK7rwrZJowpstcaxQ6
Claude