I run a number of Shelly devices on an iOT vlan with opnsense, but I used the integration- could that be an option?
I found a couple of the shelly devices (the humidity & temperature sensor and the smoke alarm) needed to be able to access HA to send updates so I created an opnsense alias to allow them just to access the ip it’s on. I could see MQTT being useful for these maybe?
I also have a couple of plugs and plus 1pm’s that just sit isolated on the vlan and get accessed by HA from the LAN. The integration was super easy to setup for these.
Are your plugins etc up to date? I had a similar issue and updating plugins seemed to fix it. YMMV.