Messages

They are providing a database that could be used by the builtin functionality. As an alternative to Maxmind or IPinfo.

Not sure if this is a permitted use of Internet registry info, though.

The Omni Group is a reputable software company targeting Mac OS and IOS with quality applications like OmniGraffle or OmniOutliner. The former is Visio on steroids. Just "insanely great" as some CEO used to say. I use it regularly - from network diagrams at work to poster layouts for my local chapter of the German Tolkien Society.

They offer a sync service to go with their apps so you can easily switch from Mac to iPad and back.

I was told here that it'll take many years before the so-called migration is required

Yes - you can install the legacy rules plugin on 26.7 and continue to use the old UI and the old rules. I don't know how many years exactly are implied here, though.

I prefer Crunchy Frog. 😬

Thanks for the great writeup.

Solange du nicht deine vollständige Konfiguration postest, wird das eine ziemliche Glaskugelei. Und meine Glaskugel ist grad in der Inspektion 😉

Also, it does not even work over different APs, only for devices connected to the same AP.

Or a bunch of Mikrotik APs managed by the same CAPsMAN with traffic processing on-capsman instead of on-cap. That feature turns them into a single AP, essentially. I have finally got it to work and I can show you on Friday. I run on-cap, though, i.e. traffic is processed on each managed AP.

you need client support

Not for VMPS. That's the good part. It "simply" does dynamic MAC address <> VLAN mapping.

802.1x is a different matter, correct.

Sounds like a job for RADIUS but ALL of your networking equipment needs to support it :)

VMPS - very Cisco specific 😉

And yes, FreeRADIUS has got a backend for that.

<27>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="1"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.384) child signalled: 9

Out of memory?

You can still - and possibly your ISP router did not do more than that - disable DHCP for unknown MAC addresses and add all clients explicitly and statically. While not a strong security measure against an experienced attacker it will still puzzle the occasional wardriver who somehow got hold of your WiFi secret. It will also keep out phones that change MAC addresses as a privacy measure etc. until you configure them to not do that.

People with the correct secret can still authenticate to your WiFi, try to catch some broadcast traffic, and give themselves a static IP address. But it's better than nothing.

Best if combined with client isolation on your access point.

Sorry, no. Unless I am paid for it this is not my affair to meddle with and not my job. And yes, I have a son, turning 23 in a couple of days, but of course I still know how one might feel about Internet access etc. for kids.

If I did not completely miss the point The OP did not start the discussion stating he does not trust the device, only that it circumvents his local DNS filters by forcing DoH/DoT.

If I was in the position of the school I would certainly do exactly that forcing my or my contractor's DNS server with my filtering in place. Maybe even force everything through a VPN.

So I would *ask* the school how they are protecting their students before dabbling in technical measures that are (IMHO) absolutely none of my business.

My printer has a static address, a DNS entry, and is managed via SNMP. 🙂

The "Firewall rule association" has been there for years including the "pass" option. It just changed to "Firewall rule" now.

I use Kea and Unbound because it's simpler. I don't want dynamic DHCP clients polluting my carefully maintained DNS zone. Why would I want "Paddys-Macbook-Pro" in my DNS? DNS entries are for servers that need to be reachable by clients, have certificates, etc.

My approach. Yours is different.

No.