BTRFS + Snapper makes automating system snapshots and updates so care-free that it almost feels wrong. 😅

With proper partitioning and backup strategies deployed during setup an admin could inexorably hose the OS and it wouldn’t be a big deal. I can count on one hand the amount of times it’s made sense to nuke a Linux machine. None of those incidents required I redeploy from scratch. Just re-install, log in, and all the data is exactly where it ought to be.

I’ve reguarly had to re-install Windows machines from scratch as if they were some eldritch beast whose rage was only calmed after the ritual sacrifice was complete.

I’m a bit late to the party. I was a network admin in another life and believe I can help out. I’ve skimmed existing conversations but not fully poured over them.

That said: I’d print the routing tables for the switches and firewall and review them. Considering firewall rules is sensible but it seems you’ve already done quite a bit of investigation there. It sounds like there is some vlan configuration missing. Like one of the switches doesn’t have the vlan interface defined or named in its vlan database.

Review the routing tables and confirm who owns each vlan and what those networks are aware of. Also toggle your logging options on so you can review them and test with more info than pass/fail.

It very well may be a OPNsense firewall knowledge thing but I’m not convinced. If you’re still working on this tomorrow I’d be happy to help root-cause the problem and fill in the gaps between RTFM and old YouTube videos. :)