In looking at blocked entry in firewall live log, the detail popup has this information in it:
...
reason: match
rid: <magnifying glass> <hex string> (clickable)
...
Firefox browser: Click "rid" launches a new tab that immediately closes. Right-click and use 'open in new window' does same - launches and immediately closes.
Edge browser: Click "Rid" remains in same tab, but tab page is blank.
I believe that occurs with all built-in/automatic rules. No config page.
Could be. I wouldn't mind if it wasn't "clickable" and I could just copy/paste the string in a focused search box in the rules area to find the match. I tried the search box in upper right but that doesn't find anything. (Separate "rant"... I often can't find even a setting using the search box...)
I use my own default block rules so I can customize the description/label, the result being that the vast majority of rules passing by in the live view are mine. I lead the description with the interface name, so the only column I normally pay attention to in the live view is "Label". I see a lot of "let out anything from firewall host itself" with a few rare "allow access to DHCP server", "block all targeting port 0", etc. If I see "Default deny / state violation rule" then I've (generally) missed something in my ruleset.
Sure I could do that too. I wasn't looking for help though, I'm just reporting it in case it can get a fix of some kind. Thanks.