So I think I thought a way to make my PfSense easier I’ll alias RFC1918 address spaces and make a reject rule for all the high risk VLAN’s to prevent east-west talking and pin hole only what I need above those rules… that should simplify a lot for my zero trusting of my home lab.