Who can reach whom, under the firewall rules you actually have loaded. ControlledBurn is an OPNsense plugin: it reads the live pf ruleset and your devices and draws what the rules allow, not live traffic, so it also shows holes nobody is using yet.
This demo runs entirely in your browser with sample data: captures from an isolated test firewall and some made-up networks. Nothing is sent anywhere. Try hovering and clicking edges, shift-clicking two nodes (on the first dataset) for the full breakdown, dragging nodes or whole segments, and the Rule check bar. In the Five VLANs home lab, see what the guests' "web only" rule really allows, and what else can reach This Firewall.
Hover nodes and edges for details; click an edge (or its label) for the rules behind it and to mark it checked; click a node to keep its links highlighted; shift-click two nodes for everything allowed and blocked between them. Drag nodes, or a segment by its box, to rearrange; drag the background to pan; scroll to zoom. Untick segments to hide them: dashed pills still show what the visible devices can reach there (click one to bring it back). In the plugin, rule names link to the rule in Firewall › Rules.