Isolating a guest VLAN on OPNsense with a Ruckus AP: no sneaking through to the main network

My Ruckus access point broadcasts a dedicated guest SSID and tags that traffic with a separate VLAN before handing it to OPNsense. The AP side is easy – Ruckus does the tagging reliably. The router side is where things go wrong if the firewall rules are in the wrong order or a step gets skipped. Here is the full setup I use to make sure a guest really cannot reach anything on the internal network.

1. Create the VLAN interface

Go to Interfaces → Devices → VLAN (in older OPNsense versions this was under Other Types) and create a new VLAN. Set the tag to match what the Ruckus is using (in my case 10) and set the parent to the physical interface the AP is connected to.

Then go to Interfaces → Assignments, add the VLAN, enable it, and give it a static IP – I use 192.168.10.1/24. That address becomes the guest gateway.

2. DHCP for the guest segment

Go to Services → DHCPv4 → [guest interface] and configure a pool, e.g. 192.168.10.100–200. For DNS, I point guests at 1.1.1.1 directly rather than the OPNsense resolver. If you use the internal resolver here and it has internal hostnames, it leaks information about your network. Keep guest DNS external.

3. Firewall rules – the part that actually matters

Go to Firewall → Rules → [guest interface]. OPNsense processes rules top-to-bottom and stops at the first match, so order is everything. The pattern is: block internal first, allow internet second.

Create an RFC1918 alias

Under Firewall → Aliases, create an alias called RFC1918 of type Network and add all three private ranges:

Using an alias keeps the rules readable and means you only have to update one place if you ever add a range.

Rule 1 – block guest-to-internal

Create a block rule:

Rule 2 – allow internet

Create a pass rule below the block rule:

Because the block rule is above the pass rule, traffic aimed at 192.168.x.x, 10.x.x.x, or 172.16.x.x is dropped before it ever hits the allow. Traffic to anything else (the internet) passes.

4. Client-to-client isolation

The firewall rules above prevent guests from reaching your network, but guests can still reach each other through the AP. The cleanest way to prevent that is to enable client isolation on the Ruckus SSID itself – it drops direct client-to-client traffic at the AP before it ever hits OPNsense. Most Ruckus controllers have this as a per-WLAN setting under the wireless or WLAN configuration.

5. Trunk configuration on the AP uplink

The Ruckus uplink port – and any switch port between it and the OPNsense NIC – must be a trunk, not an access port. It needs to carry both the native (untagged) LAN traffic and the tagged guest VLAN. If that port is in access mode, the VLAN tag gets stripped and guest clients land silently on your main network with no firewall rule in sight.

If there is a managed switch in between, verify the VLAN is allowed on every trunk link in the path.

6. Verify it works

Connect a device to the guest SSID and run these checks:

• Ping 192.168.10.1 (guest gateway) – should succeed
• Ping your LAN gateway (e.g. 192.168.1.1) – should fail
• Ping 1.1.1.1 – should succeed
• Access a local server by IP – should fail

You can also run a packet capture under Interfaces → Diagnostics → Packet Capture on the guest interface to confirm traffic is arriving tagged and being processed by the right interface.

Gotchas

• Wrong rule order. This is by far the most common mistake. If the pass-any rule is above the RFC1918 block, guests get full access to the internal network. Always block first, allow second.
• Forgetting the RFC1918 alias. Writing three separate block rules (one for each private range) is fine, but if you miss one range you leave a gap. The alias approach blocks all three in one rule and is harder to get wrong.
• Access port instead of trunk. An AP plugged into an access port on a switch never delivers tagged frames to OPNsense. The VLAN interface gets created on the router but never sees any traffic. This is easy to diagnose with the packet capture – if there is nothing on the VLAN interface, look at the trunk config.
• Using the internal DNS resolver for guests. If OPNsense’s unbound resolver has overrides for internal hostnames, pointing guest DHCP at it lets guests resolve your internal services by name even if the firewall blocks the actual connections. Use an external resolver like 1.1.1.1 or 9.9.9.9 for the guest segment.
• IPv6. If your network has IPv6, replicate the firewall rules for IPv6 as well, or disable IPv6 on the guest interface entirely. An IPv4-only block with IPv6 left open is a hole.

Result

With this setup, guests get internet access and nothing else. They cannot reach the LAN, cannot ping internal hosts, and cannot enumerate internal services through DNS. The Ruckus handles client isolation inside the guest SSID itself, and OPNsense enforces the boundary at the network layer. Between the two there is no realistic path from the guest segment onto the internal network.