--- title: Selecting Policy Routes in OPNsense from Home Assistant description: A practical guide to controlling OPNsense firewall alias-based policy routing from Home Assistant. The setup uses OPNsense's Firewall API to enable/disable... canonical: https://daily.dev/posts/selecting-policy-routes-in-opnsense-from-home-assistant-9ghsbqgz0 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Selecting Policy Routes in OPNsense from Home Assistant | daily.dev og:description: A practical guide to controlling OPNsense firewall alias-based policy routing from Home Assistant. The setup uses OPNsense's Firewall API to enable/disable... og:url: https://daily.dev/posts/selecting-policy-routes-in-opnsense-from-home-assistant-9ghsbqgz0 og:image: https://api.daily.dev/og/posts/9GhsBqgz0.png og:image:alt: Selecting Policy Routes in OPNsense from Home Assistant og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Selecting Policy Routes in OPNsense from Home Assistant **[apalrd's adventures](https://daily.dev/sources/apalrd)** · 8 min read · 0 upvotes · 0 comments ## Summary A practical guide to controlling OPNsense firewall alias-based policy routing from Home Assistant. The setup uses OPNsense's Firewall API to enable/disable MAC-based aliases, which in turn controls whether specific devices route traffic through a VPN or secondary WAN. The tutorial covers creating API users, MAC and destination aliases, firewall rules for IPv4/IPv6, RESTful commands in Home Assistant, and input boolean automations. DNS handling considerations and IPv6 quirks (SLAAC, NPT, NAT66) are also addressed. Use cases include selective VPN routing for media players, parental controls via traffic blocking, and multi-WAN selection. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I control OPNsense policy routing from Home Assistant using the API? OPNsense's Firewall API does not expose direct rule control, but it does allow enabling/disabling aliases. The approach is to create MAC-based aliases per device per destination, nest them in a destination alias, and write firewall rules referencing that alias. Home Assistant then uses RESTful commands to toggle the alias UUID via the API and calls the reconfigure endpoint to apply changes, triggering or removing the policy route. _Home lab network engineers managing OPNsense and Home Assistant together track integration patterns like this on daily.dev._ ### How does OPNsense resolve MAC aliases to IP addresses for firewall rules? OPNsense periodically scans the ARP cache (IPv4) and NDP cache (IPv6) to determine the current IP addresses associated with a device's MAC address. This means MAC-based aliases automatically track IP changes, but there is a risk of traffic 'leaking' if a device uses IPv6 temporary privacy addresses, since the NDP cache may not reflect the latest address immediately. _Developers building home network automation find edge cases like IPv6 SLAAC leakage discussed alongside OPNsense topics on daily.dev._ ### How do I find the UUID of an OPNsense alias for use in API calls? The easiest method is to back up the OPNsense configuration, open the resulting XML file in a text editor, and search for the alias name. The alias entry and its UUID will appear nearby in the XML. This UUID is required when making API calls to enable or disable the alias programmatically. _Those automating OPNsense via API find practical workarounds like this shared regularly on daily.dev._ ## Similar posts on daily.dev - [Adding a backup Internet WAN on my OPNsense Router](https://daily.dev/posts/adding-a-backup-internet-wan-on-my-opnsense-router-a7gbniplm) · Jeff Geerling · 1 upvotes · 0 comments - [I blocked my devices from bypassing my DNS server with one firewall rule](https://daily.dev/posts/i-blocked-my-devices-from-bypassing-my-dns-server-with-one-firewall-rule-layv2qvxn) · XDA Developers · 2 upvotes · 0 comments - [Add a VLAN to OPNsense in Just 26 Clicks Across 6 Screens](https://daily.dev/posts/add-a-vlan-to-opnsense-in-just-26-clicks-across-6-screens-qerabobc9) · Lobsters · 1 upvotes · 0 comments --- Tags: [#vpn](https://daily.dev/tags/vpn) [View this post on daily.dev](https://daily.dev/posts/selecting-policy-routes-in-opnsense-from-home-assistant-9ghsbqgz0) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Selecting Policy Routes in OPNsense from Home Assistant","url":"https://daily.dev/posts/selecting-policy-routes-in-opnsense-from-home-assistant-9ghsbqgz0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/selecting-policy-routes-in-opnsense-from-home-assistant-9ghsbqgz0"},"datePublished":"2026-08-11T08:55:33.806Z","dateModified":"2026-08-11T09:34:59.629Z","description":"A practical guide to controlling OPNsense firewall alias-based policy routing from Home Assistant. The setup uses OPNsense's Firewall API to enable/disable...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/99fec8e685138e6f26cd9b8922dec204?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/99fec8e685138e6f26cd9b8922dec204?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"apalrd's adventures","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"apalrd's adventures","logo":"https://media.daily.dev/image/upload/s--4zkx8dRj--/f_auto,q_auto/v1786438309/logos/apalrd?_a=BAMAMicg0","url":"https://daily.dev/sources/apalrd"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/selecting-policy-routes-in-opnsense-from-home-assistant-9ghsbqgz0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"vpn","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"apalrd's adventures","item":"https://daily.dev/sources/apalrd"},{"@type":"ListItem","position":3,"name":"Selecting Policy Routes in OPNsense from Home Assistant"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/selecting-policy-routes-in-opnsense-from-home-assistant-9ghsbqgz0#faq","mainEntity":[{"@type":"Question","name":"How do I control OPNsense policy routing from Home Assistant using the API?","acceptedAnswer":{"@type":"Answer","text":"OPNsense's Firewall API does not expose direct rule control, but it does allow enabling/disabling aliases. The approach is to create MAC-based aliases per device per destination, nest them in a destination alias, and write firewall rules referencing that alias. Home Assistant then uses RESTful commands to toggle the alias UUID via the API and calls the reconfigure endpoint to apply changes, triggering or removing the policy route. Home lab network engineers managing OPNsense and Home Assistant together track integration patterns like this on daily.dev."}},{"@type":"Question","name":"How does OPNsense resolve MAC aliases to IP addresses for firewall rules?","acceptedAnswer":{"@type":"Answer","text":"OPNsense periodically scans the ARP cache (IPv4) and NDP cache (IPv6) to determine the current IP addresses associated with a device's MAC address. This means MAC-based aliases automatically track IP changes, but there is a risk of traffic 'leaking' if a device uses IPv6 temporary privacy addresses, since the NDP cache may not reflect the latest address immediately. Developers building home network automation find edge cases like IPv6 SLAAC leakage discussed alongside OPNsense topics on daily.dev."}},{"@type":"Question","name":"How do I find the UUID of an OPNsense alias for use in API calls?","acceptedAnswer":{"@type":"Answer","text":"The easiest method is to back up the OPNsense configuration, open the resulting XML file in a text editor, and search for the alias name. The alias entry and its UUID will appear nearby in the XML. This UUID is required when making API calls to enable or disable the alias programmatically. Those automating OPNsense via API find practical workarounds like this shared regularly on daily.dev."}}]} ```