Messages

perhaps signs of a hardware problem. Perhaps you could tell what hardware is involved.

It's a generic mini-PC; if there's a spot to a hardware report or something that would be useful, I can post that, but I didn't find anything while poking through the webUI menus. It would be great if there were better logs in OPNsense to help troubleshoot the issues.

This machine is not as easy to disassemble and would require significant downtime to do so, hence the lesser detail on hardware specs than the other post. Based on the dashboard, looks like 8GB RAM, 100 GB SSD, load averages 0.60, 0.42, 0.30. Not sure what other hardware information is relevant without being able to see/have more detailed logs or something specific to troubleshoot/change.

This is not how unix or unix-like works. You won't find a hardware report "button". And there are logs. They all live in /var/log/ . Inside there is a log for each service. Technically speaking, if the service is set to log but that's a different story for another day. For now, is what is there.
So you will have to get to know the basic utilities like cat, grep, head, tail and friends.
The ones I would start with are dmesg i.e. "sudo dmesg" but best with ssh from another machine so you can scroll up and down.

perhaps signs of a hardware problem. Perhaps you could tell what hardware is involved. The linked thread has a lot of realtek stuff on it, it might still be the source of problems but is impossible to tell here without basic details provided. It could be almost anything.

Right. It's the inverted destination in your rule that made me think is what you wanted to do.
Should work then. Perhaps needs a reset of states.
Perhaps this helps https://forum.opnsense.org/index.php?topic=49147.0.
ps.The preferred way is using block to anything not in RFC1918

Thank you @Patrick M. Hausen. I meant to say thanks before and got distracted with implementing the thing.
I am old school and prefer non-docker things so this was in the end my first proper dabble with docker, so it took me longer than expected. A small LXC container on a proxmox node, all good and easy. But I wanted to also have notifications. That was what took me time to figure out -with help- how to get them. I ended up with a mattermost installation on the same container that is "part of the installation" of scrutiny. I now get them to my mobile phone as app notifications.
I feel a more in control of the status of disks all around the house: laptops of various OSes, NAS, workstations.
Thank you.

One "solution" I employed only last week where I wanted to isolate my employer-provided laptop from being on my LAN, after failing to utilise ACLs on my CSS mikrotik managed switch, was to add a new VLAN on it. Then put a standalone eero router in bridge mode into that port (port-based VLAN). Appropriate firewall rules for it of course.
Of course no need to use eero just any wifi AP in bridge mode or similar functionality would do.

device to device traffic on the same network segment does not go through your router. You can block the devices from going out to the internet but not from talking to each other, unless they go from one network to another, that needs to be _routed_ by your router i.e. OPN.
Presumably they are all connected via a switch plugged into the internal_lan interface., right?

can't remember exactly but can you try with the backup config in the root of the usb device instead of being in /conf/
I think I remember that the importer will look only in the root.

I don't know why I'm being quoted since we're agreeing and saying the same thing. The advice is for the OP.

What makes you think that you need to install the bootloader to the secondary drive?

How are you going to boot from the secondary drive when the primary one fails?

He mentioned a secondary drive so I assumed a mirror.

It might just need to install the bootloader to the disk. Can you boot to a usb stick/live freebsd distro? Easier to use the native freeBSD tools not the linux ones for this case.
When booted to the live session, show the partitions on this disk.:
$gpart show

with loads of successful upgrades so far I can only assume some sort of setup/settings have come to bite.
What makes you think that you need to install the bootloader to the secondary drive? Do you have a mirrored pair of disks for the OS ? If yes, then it is a likely possibility but if you can boot after the upgrade, then you can look at that afterwards.
What's the status now, is it rolledback via a snapshot?

Note that if you had to put the isp router back in and then had router-behind-a-router, then that could account for no clients hitting it.

@cookiemonster was there a time when Unbound in OPNsense didn't support multiple DoT resolvers?  I don't remember but I'm curious what stubby is adding in that chain.

It probably didn't support multiple DoT resolvers at the time. I set it up some years ago and since multiple OPN upgrades so it has stayed. Maybe it was also some additional options that made it more desirable at the time: options of distribution to upstreams, ciphersuites, and other available knobs to tweak. I fail to remember.
Now looking at Unbound, if simply having DoT with multiple upstreams is the only wanted feature then you are right, Unbound on it's own would do.
The setup has served me well all along so I'm happy to leave it as it is. Good point though.

I still use stubby on OPNSense which I think I documented sometime here. However it was not to have logic to direct queries in different directions. In fact that is news to me that it can do that. Mine use has clients directed to AdgH , which then has Unbound as the upstream resolver. Then Unbound forwards ALL queries to Stubby. Stubby is configured with a few DoT upstream resolvers in round-robin fashion.
In other words the dns selection for clients if I wanted would go on AdGH as Patrick says.

Problem here is that we can't guess your internal setup. You talk about routing but all "internal" traffic i.e. devices talking to each other in your "LAN", they don't go through your OPN router. They talk via a switch that you will have downstream of OPN and plugged into that LAN port.
That said, it could be routing if you have more than one network segment and traffic has to go through your OPN, but this is what we can't guess. You must give us all the details.
Finally if resetting that interface seems to make a difference, that suggests the router is involved somehow. Again tell us the setup.
And hello to  you too.

All good