Hi
After we updated to 26.7 we struggling with floating rules.
So for example, we have a rule where allowing remote networks via IPSec to internal networks as interface rule and another role where deny all traffic to other subnets as floating:
Floating rule:
Interface: nothing selected
Quick: false
Action: Block
Protocol: *
Source: *
Port: *
Destination: alias_all_int (as subnet alias 10.16.0.0/20)
Port: *
Interface rule:
Interface: IPsec encapsulation
Quick: true
Action: Pass
Protocol: *
Source: alias_net_ipsec_dest3 (as subnet alias 172.27.9.0/24 192.168.2.0/24 192.168.42.0/24)
Port: *
Destination: *
Port: *
- Before upgrade it went fine
- After upgrade, the first rule (floating) matches and blocks all traffic
- After disabling, an automatic generated (default blocking) rule blocks the traffic, so enabling again...
- I removed the "IPsec encapsulation" from the interface list, so it moves up to the floating rules, i moved it before the blocking rule -> still blocking the IPsec traffic
- Rebooting the FW -> now, the right rule is taken and the traffic is accepted
- Moving rule back as interface rule ("IPsec encapsulation"), still running fine
- FW reboot -> The blocking rule wins and the traffic is blocked again
- Snapshot restore to 26.1.11 -> Everything is working again
So I think, there is something where goes wrong in 26.7. Maybe interesting: We started with this FW with 26.1 and worked from beginning on with "Firewall > Rules [new]", nothing was edited or added in "Firewall > Rules"...
Ivo
Floating rules are processed before interface rules, it's expected behaviour: https://docs.opnsense.org/manual/firewall.html#processing-order
They didn't change with 26.7, but it's different between legacy and "new" rules.
Quote from: ivoruetsche on July 21, 2026, 12:10:15 AMFloating rule:
Interface: nothing selected
This makes no sense to me to begin with.
Quote from: Bob.Dig on July 22, 2026, 10:33:10 PMThis makes no sense to me to begin with.
In the old system this meant "all interfaces". You can still select "any" in the new system.
Quote from: userfw on July 22, 2026, 10:07:24 PMFloating rules are processed before interface rules, it's expected behaviour: https://docs.opnsense.org/manual/firewall.html#processing-order
Yes, but the first (blocking) rule has "Quick: false" and it should not be handled different after a reboot and at 26.1.
Quote from: userfw on July 22, 2026, 10:07:24 PMThey didn't change with 26.7, but it's different between legacy and "new" rules.
On this firewall, we never used the legacy role dialog, from scratch we used the "new" rules and I can imagine, this is maybe the problem.
Ivo
From my perspective, this looks like a bug in 26.7, because it should not happen, that the firewall has a different behavior after clicking "Apply" and after a reboot.
After reboot, the behavior is the same like in 26.1, but not after "Apply".
So we have to stay at 26.1 as long this is not fixed.
Thanks a lot
Ivo
Have you tried resetting the firewall states after clicking "Apply"? This is not done automatically.
It's related to alias (https://github.com/opnsense/core/issues/10621)