I did a clean install to 26.7.3_11 and now see events in Live Log that did not seem to be there before. Is this normal? Without a label, there is no way to track the specific rule that triggered it?
Looking at the list of automatically generated rules, it should be allowed.
(https://forum.opnsense.org/index.php?action=dlattach;attach=58006)
[Edit] Rephrased response.
Agreed, but then shouldn't this be displayed as the Label? "IPv6 RFC4890 requirements (ICMP)"
Check setting for Disable RFC4890 requirement rules in Firewall -> Settings -> Advanced, is it unticked?
All loggings settings in Advanced are unchecked. And this is how it was setup in older versions. So still puzzled why these appear.
Also, just realized the rule is set to Pass, not block.
And "Disable RFC4890 requirement rules" is unchecked.
Does this show anything interesting?
action [block]
class 0x00
dir [in]
dst ff02::16
dsthostname ff02::16
flow 0x00000
hoplimit 1
interface bridge0
ipversion 6
label
length 76
protoname icmp
protonum 1
reason ip-option
src ::
srchostname ::
status 2
The OPNsense installation I've set up have had the Logging options in Firewall-Advanced enabled by default, with exception to Outbound NAT.
The
reason line gives you a clue.
Extract from pf.conf(5)
Quoteallow-opts
By default, packets with IPv4 options or IPv6 hop-by-hop or destina-
tion options header are blocked. When allow-opts is specified for a
pass rule, packets that pass the filter based on that rule (last
matching) do so even if they contain options. For packets that match
state, the rule that initially created the state is used. The im-
plicit pass rule, that is used when a packet does not match any
rules, does not allow IP options or option headers. Note that IPv6
packets with type 0 routing headers are always dropped.
I'd expect a log like that to be due to "Firewall: Settings: Normalization" -> "Disable interface scrub", also visible under "Firewall: Diagnostics: Statistics" -> "rules", "rules" -> "filter rules", usually the top entry. I believe you can allow options via rules: check "allow options" under "Advanced features".
Disable interface scrub is un-checked. Needs to stay this way because I use Wireguard:
If checked, mss clamping will also be disabled
Under Edit rule: "advance mode"
Allow options:
Help Text: This allows packets with IP options to pass. Otherwise they are blocked by default.
I think this is getting closer to the answer. I do not have a problem with having this traffic blocked. Only that it shows up under Live View, and that it does not have a "Label". Maybe this was changed in FreeBSD [pf.conf(5)] and the event, which is valid, is bypassing the suppression in OPNsense? Just a guess.