Comprehensive OPNsense Installation and Configuration

I'm looking for a network professional with strong experience in OPNsense to build a secure and modular infrastructure that includes:

1. VPN (WireGuard or OpenVPN) with per-peer dynamic VLAN access control
Set up a VPN endpoint under a dedicated VPN VLAN
Each VPN peer must have custom access to specific VLANs, dynamically adjustable:
Example: peer1 → access to VLAN LAN + MEDIA
peer2 → access to VLAN LAN + specific hosts in IOT
Ability to manage VLAN access easily per peer, either via rules or UI
Static IP assignment per VPN peer
Optional: provide a simple UI or script to manage access rules on-the-fly

2. Captive Portal for VPN users
After establishing a VPN connection, users must authenticate through a captive portal
Portal should enforce authentication before granting access to the network
Support for:
Local user database or LDAP/Radius backend
Logging (timestamps, IPs, VLAN, duration)
Monitoring who is connected and what they’re accessing
The portal must apply only to VPN connections, via the dedicated VPN interface (e.g., ovpnsX, wgX)

3. Internal DNS filtering (like Pi-Hole or AdGuard Home)
Deploy an internal DNS filtering system to block:
Ads, malware, tracking domains, etc.
It should:
Be usable by all VLANs
Provide logs and filtering rules
Offer an easy-to-use UI for editing blacklists/whitelists
Traffic redirection to enforce the use of this DNS internally

4. Local reverse proxy for internal domains only (.lan)
Set up a separate reverse proxy (not Caddy) exclusively for internal .lan domains:
Example: nas.lan → 192.168.30.10:5000
plex.lan → 192.168.40.10:32400
Requirements:
Easy domain + backend port mapping
Must automatically (or very easily) configure internal DNS to match
SSL optional (self-signed is acceptable)
Bonus: Provide a web interface or tool to create new mappings (domain + target IP:port) and automatically update DNS entries

5. Documentation & Admin Simplicity
Deliver complete documentation for:
Adding new VPN peers
Managing VLAN access per peer
Monitoring and logging Captive Portal activity
Maintaining the DNS filtering system
Adding or removing internal .lan domains and reverse proxy routes

Existing Infrastructure:
OPNsense is already installed and configured
VLANs in place: LAN, MEDIA, IOT, VPN, ADMIN, etc.
Caddy reverse proxy is already used for public-facing domains (do not use it here)
Admin access via VPN or LAN is available

Deliverables:
Fully functional, secured VPN with dynamic VLAN control per peer
VPN-based captive portal access control with logging
Local DNS filtering server (Pi-Hole / AdGuard style)
Internal .lan reverse proxy with DNS automation
Clear, reusable documentation (PDF or Markdown)