I wanted one command — /ipad-internet off — that instantly cuts the household iPad’s internet, and /ipad-internet on to give it back. Simple ask. The interesting part is doing it correctly: instantly (no waiting on a config save), reversibly, without disturbing the LAN (AirPlay, printers, local media should all keep working), and — most importantly — in a way that can never accidentally knock a different device offline.

It ended up as a Claude Code skill backed by a careful bit of OPNsense / pf design. This post is about that design: why it uses a pf table instead of editing the config, how it survives the iPad’s shifting IP and Apple’s private Wi-Fi MAC, and the ownership guard that makes the “wrong device” failure mode structurally impossible.