How to Connect NordVPN and Isolate VPN Traffic on a Separate AP (Part 1)

{{< notice “warning” >}} Outdated {{< /notice >}}

{{< notice “info” >}} This is an advanced, multi-part configuration covering VLANs, interfaces, firewall rules, VPN, and the Wi-Fi AP. Read the menus carefully before applying changes. {{< /notice >}}

I. Create a VLAN and interface

1. Create a VLAN

• Log in to OPNsense and open Interfaces > Other Types > VLAN.
• Click Add.
• Select the LAN port as Parent interface.
• Enter a VLAN tag such as 11, add a description such as VPN, and click Save.

2. Create an interface for the VLAN

• Open Interfaces > Assignments and add an interface. Under New interface, select vlan11 on xxx (VPN).
• The new interface may be named OPT1. Open it, enable it, and configure:

Field	Value	Notes
Description	VPN_LAN	Easy-to-remember name
Block Private networks	Unchecked
Block bogon networks	Unchecked
IPv4 Configuration Type	Static IPv4
IPv6 Configuration Type	None
MAC address / MTU / MSS	Empty
Speed and duplex	Default
Static IPv4 address	192.168.200.1/24	Use a subnet appropriate for your OPNsense LAN
IPv4 Upstream Gateway	Auto-detect

Click Save, then Apply changes.

3. Configure DHCP for VPN_LAN

Open Services ‣ DHCPv4 ‣ VPN_LAN and set:

Field	Value	Notes
Enable	Checked
Range	192.168.200.100 to 192.168.200.200	DHCP range
DNS Server	192.168.200.1
Gateway	192.168.200.1

4. Configure the firewall

Open Firewall ‣ Rules ‣ VPN_LAN.

Allow DNS:

Field	Value
Action	PASS
Interface	VPN_LAN
Protocol	TCP/UDP
Source	VPN_LAN net
Destination	VPN_LAN Address
Destination port	DNS/DNS
Description	Allow DNS

Save the rule.

Allow VPN_LAN Internet access:

Field	Value
Action	Pass
Interface	VPN_LAN
Protocol	any
Source	VPN_LAN net
Destination	any
Destination port	any
Description	Allow VPN_LAN Network

Save and apply the changes.

{{< notice “tip” >}} Continue with Part 2 — Configure NordVPN on OPNsense. {{< /notice >}}