Hi there,
in Firewall: Settings: Advanced all of the following options are set to disabled:
Default block Log packets matched from the default block rules
Default pass Log packets matched from the default pass rules
Outbound NAT Log packets matched by automatic outbound NAT rules
Bogon networks Log packets blocked by 'Block Bogon Networks' rules
Private networks Log packets blocked by 'Block Private Networks' rules
nevertheless the firewall creates entries from rule "Default allow LAN to any rule":
LAN In 2026-07-28T09:51:18 PGM xxx.xxx.xxx.xxx 234.1.1.2 block Default allow LAN to any rule
and why is it logging blocks for an allow-rule?
Could someone please help me to understand this behaviour?
thank you.
The "Default allow LAN to any rule" is an automatically created rule for your first LAN. Other than that, it is then handled like any other manual rule, i.e. it can have logging enabled or disabled.
The settings in Firewall:Settings:Advanced are for rules "behind the scenes" which are not part of your own rule set and which - apart form some checkboxes - cannot be manipulated from your own ruleset.
I cannot say why this log entry was created, however, there is a small info button on the right of each log line (at least in the live log), if you click on it, you will see the details. Within those details, you will find a link to the "rid" (aka rule id), which gives you the precise rule that led to this log entry.
the rid points to a rule named "Default allow LAN to any rule", in this rule the action is "pass" and logging is disabled...
i still don't understand, why there are blocks logged with reference to "Default allow LAN to any rule"
Whenever you change rules the ids used by the pf itself and logging can get out of sync. This has been discussed in a couple of threads. I don't quite remember if clearing all firewall states fixes that problem, but probably that is the case.
unfortunately resetting "state table" and "source tracking" under "Firewall: Diagnostics: States" changed nothing, logs are still generated.
this behaviour startet right after the update from 26.1.11_10 to 26.7.1_1
so i upgraded another OPNSense-Installation. Same upgrade-path from 26.1.11_10 to 26.7.1_1
before upgrading i migrated all legacy firewall-rules and deleted them
after the upgrade the logging starts immediately as on the other OPNSense.
on both OPNSense i see this only with PGM-Protocol, maybe it's a bug with PGM-Protocol, not in general with firewall rules...
How reliable is Firewall:Diagnostics:States for troubleshooting (https://forum.opnsense.org/index.php?topic=52351.msg270231#msg270231)