The what are you trying to accomplish with ClamAV?
You can use it to filter email for viruses just like you can filter for spam with rspamd, but both require that you intercept and inspect the mails at the application level by using e.g. postfix as a mail relay.Frequently this is implemented for corporate uplinks with fixed IP addresses. Inbound mail delivered to postfix on OPNsense, scanned and filtered, then forwarded to e.g. internal MS Exchange.With web traffic it's similar. You need a web proxy intercepting and scanning all that traffic. There is no functional malware scanning of "the network".
You still need a proxy like squid (available as a plugin) to work together with icap. And then you need to configure all your end devices to use the proxy for "surfing".Or you try and set up a transparent proxy which means breaking TLS encrypted connections in the middle, so you need to create your own CA (certification authority), have all devices trust that certificate, and squid will create certs for e.g. forum.opnsense.org on the fly to spoof your browsers.This leads to a whole new bunch of problems with applications that use certificate pinning like online banking should etc. etc. Every experienced admin I know including myself recommends strongly against it. The whole point of TLS is end to end confidentiality and integrity. Don't mess with it.The consequence of course is that it is entirely impossible to scan traffic for malicious content.You can still use AdGuard Home and blocklists (which I would recommend) or CrowdSec (which I also recommend) to block malicious hosts. Just not malicious content.
