I wanted one command — /ipad-internet off — that instantly cuts the household iPad’s internet, and /ipad-internet on to give it back. Simple ask. The interesting part is doing it correctly: instantly (no waiting on a config save), reversibly, without disturbing the LAN (AirPlay, printers, local media should all keep working), and — most importantly — in a way that can never accidentally knock a different device offline.

It ended up as a Claude Code skill backed by a careful bit of OPNsense / pf design. This post is about that design: why it uses a pf table instead of editing the config, how it survives the iPad’s shifting IP and Apple’s private Wi-Fi MAC, and the ownership guard that makes the “wrong device” failure mode structurally impossible.

I wanted my house to say, out loud, “the mail truck is out front” — the moment the USPS truck pulls up, spoken through the same Home Assistant TTS pipeline that runs the rest of the place. Not “a vehicle was detected.” Specifically the mail truck.

The gap between those two sentences is the whole project. My NVR (Frigate) is very good at “there’s a truck in the driveway zone” and completely incapable of “that’s a USPS LLV.” Closing that gap meant adding a small second-stage classifier that looks at the snapshot Frigate already captured and decides what kind of truck it is — running on hardware I already own, with no cloud vision API. It ended up as a zero-shot CLIP classifier, and along the way it picked up a second job I never planned: catching the garbage truck too.

I run an ADS-B receiver at home — it decodes the transponder broadcasts from aircraft overhead, plots them on a live map, and feeds the data to FlightAware. It started life the lazy way: an RTL-SDR dongle plugged into a server indoors, with a run of coax to an antenna. That works, but it’s the wrong topology if you want range, and I wanted to move the whole thing up high and outdoors.

Two things came out of that project worth writing down. First, a diagnostic detour that taught me the map wasn’t lying to me even though it looked like it was. Second — the real content — how to relocate an SDR receiver to the top of a mast without breaking MLAT, which is the part most “just put a Pi outside” guides skip.