"
Just a comment on this as it was giving me a fair bit of difficulty doing the same thing (basically spoofing an IP address within a particular vlan for traffic originating from another vlan). The critical thing I had missed was the source NAT has to be applied on the interface where you want the spoofed IP.
Option B: Source NAT / Outbound NAT (e.g., Hiding source IPs across VLANs)
If you need traffic leaving VLAN_10 into VLAN_20 to appear as if it originates from the OPNsense VLAN_20 interface address rather than the client's actual IP:
1. Navigate to Firewall > NAT > SourceNAT.
2. Change the mode from "Automatic Source NAT" to "Hybrid Source NAT" and click Save.
3. Click + Add to create a manual outbound rule:
• Interface: The destination VLAN interface (e.g., VLAN_20).
• TCP/IP Version: IPv4.
• Protocol: any.
• Source Address: VLAN_10 subnet (e.g., 192.168.10.0/24).
• Destination Address: VLAN_20 subnet (or any).
• NAT Address: Select Interface Address (the OPNsense IP of VLAN_20 or you can use an individual host/virtual IP if you have created one
Option B: Source NAT / Outbound NAT (e.g., Hiding source IPs across VLANs)
If you need traffic leaving VLAN_10 into VLAN_20 to appear as if it originates from the OPNsense VLAN_20 interface address rather than the client's actual IP:
1. Navigate to Firewall > NAT > SourceNAT.
2. Change the mode from "Automatic Source NAT" to "Hybrid Source NAT" and click Save.
3. Click + Add to create a manual outbound rule:
• Interface: The destination VLAN interface (e.g., VLAN_20).
• TCP/IP Version: IPv4.
• Protocol: any.
• Source Address: VLAN_10 subnet (e.g., 192.168.10.0/24).
• Destination Address: VLAN_20 subnet (or any).
• NAT Address: Select Interface Address (the OPNsense IP of VLAN_20 or you can use an individual host/virtual IP if you have created one
