New plugin proposal: Xray-core proxy client with transparent LAN routing

Hi,

I'd like to propose a new plugin for OPNsense that provides a web UI for managing Xray-core as a transparent proxy client. When enabled, it routes all LAN traffic through a proxy tunnel without requiring any configuration on individual devices.

Problem

There's currently no OPNsense plugin for Xray-core integration. Users who want to route LAN traffic through a VLESS, VMess, Shadowsocks, or Trojan tunnel must manually configure xray from the command line, create TUN interfaces, set up gateways, and write firewall rules. Each client device would otherwise need its own SOCKS or HTTP proxy configuration.

Use cases

• Privacy / censorship circumvention: Route all household or office traffic through a remote proxy without touching individual devices — phones, IoT, smart TVs, and guest devices all benefit automatically
• Single-toggle tunnel control: Enable or disable tunneling for the entire LAN from the web UI without reconfiguring any clients
• Multiple server management: Import and switch between server profiles from standard proxy URIs (vless://..., vmess://..., ss://..., trojan://...) — useful for users with multiple VPS endpoints or providers
• Geo-restriction bypass: Transparently route LAN traffic through a specific region's endpoint for services that require a particular location

How it works

• Manages xray-core and tun2socks to create a TUN-based transparent proxy
• Supports VLESS (with XTLS/Reality), VMess, Shadowsocks, and Trojan protocols
• Registers a virtual interface and gateway for policy-based routing
• Adds/removes firewall rules dynamically via the _firewall() plugin hook — rules are only active while the service is running
• Web UI with tabs for General settings, Servers, Import, and Log

Dependencies

• xray-core — available in FreeBSD ports as security/xray-core
• tun2socks (xjasonlyu/tun2socks) — not currently in FreeBSD ports, though it is a Go project (MIT license) that officially supports FreeBSD and provides FreeBSD binaries in releases. I'm open to submitting it to FreeBSD ports in parallel, or exploring an alternative approach if preferred

Questions for maintainers

1. Is the tun2socks dependency being outside FreeBSD ports a hard blocker, or would it be acceptable if I submit it to ports in parallel?
2. Should I start with a minimal first version (e.g., VLESS-only, fewer files) and expand in follow-up PRs?
3. Is net/ the right category, or would another category be more appropriate?

Happy to adjust scope, naming, or approach based on your feedback before submitting a PR.

This proposal names no files or tests; start by reviewing the existing net/ plugin conventions and the _firewall() plugin hook. Check how xray-core and tun2socks can be packaged for FreeBSD, then resolve the requested scope, dependency strategy, and initial protocol set with maintainers. Done requires an agreed implementation plan before coding.