I know it can be done from listening interfaces. Has anyone come up with a creative way to block access to the router login page?
Everything I've tried from YouTube isn't working or exactly what I am trying to do
You most likely have a rule in your IoT zone or Floating that accidentally allows access to the webgui.
Most likely a "Destination Any" rule.
Agreed, you're probably allowing it somewhere.
I have a floating rule (all interfaces) that blocks access to ports 22 & 443 on "This Firewall" and when I try to point a mobile phone to the OPNsense GUI I'm told to go pound sand:
mobile-to-firewall.png
While you can't block traffic between clients on the same subnet, you can still block when the firewall is the destination because by definition those packets have to go to the firewall interface.