Messages

Disable interface scrub is un-checked. Needs to stay this way because I use Wireguard:
If checked, mss clamping will also be disabled

Under Edit rule: "advance mode"
Allow options:
Help Text: This allows packets with IP options to pass. Otherwise they are blocked by default.

I think this is getting closer to the answer. I do not have a problem with having this traffic blocked. Only that it shows up under Live View, and that it does not have a "Label". Maybe this was changed in FreeBSD [pf.conf(5)] and the event, which is valid, is bypassing the suppression in OPNsense? Just a guess.

Could this be it?
https://github.com/opnsense/core/commit/b9a65b152eb155db4603b9318c99c599466b5d95

I followed all the links. But it seems to me this is still an open issue, right? For example:
"However, the interfaces widget still had a feedback loop due to the inserted scrollbar. Fix this by using borderBoxSize to determine width without overflow/scrollbar interference."
It seems like these patches should be in latest version, but not sure. So is this a work in progress?
In any event, thanks for supplying more context on this.

Version 26.7.3_11 (clean install)
After login, the Dashboard shows "Interface Statistics" with a very long vertical dimension. On the automatic refresh, it returns to normal, configured size. Is this a "Theme" issue, or something else?

All loggings settings in Advanced are unchecked. And this is how it was setup in older versions. So still puzzled why these appear.
Also, just realized the rule is set to Pass, not block.
And "Disable RFC4890 requirement rules" is unchecked.

Does this show anything interesting?

action    [block]
class      0x00
dir       [in]
dst      ff02::16
dsthostname   ff02::16
flow      0x00000
hoplimit   1
interface   bridge0
ipversion   6
label   
length      76
protoname   icmp
protonum   1
reason      ip-option
src      ::
srchostname   ::
status      2

Agreed, but then shouldn't this be displayed as the Label? "IPv6 RFC4890 requirements (ICMP)"

I did a clean install to 26.7.3_11 and now see events in Live Log that did not seem to be there before. Is this normal? Without a label, there is no way to track the specific rule that triggered it?

[Quality]

Under:
System: Gateways: Configuration
You need to setup a "Monitor IP".
For IPv4, use comcast dns: 75.75.75.75
For IPv6, try google dns: 2001:4860:4860::8844
Set  Data Length = 0 (Advanced)
I think once you do this, Reporting: Health: Quality will show up.
Look for  "Monitor IP" in official OPNsense docs.

To resolve the Comcast issue, be prepared for a very long ordeal. In my case, more than a year, and over 30 service calls. I hope you have better luck. Also, in my experience, Comcast does not like to look at your Cable Modem logs. And certainly not OPNsense. They will yry to force you to their own equipment, which does not allow you to see anything.

When dealing with them, you might want to keep it as simple as possible by performing 'ping -t 75.75.75.75 > comcast_error.txt' and importing the data to excel. Reporting: Health: Quality will show you a very good picture of what is happening, but comcast may not understand the image.

I hope I have read your post correctly, but this all seems to point to a comcast issue.

EDIT: And I would reset tunables back to their default.

Does Reporting: Health: Quality look similar to this? A constant ping to an internet IP will match the graph. I am convinced it is a Comcast issue. Many service calls, over the years, improved the internet connection, but never 100%. Services like Verizon never had these random drop-outs.
Time stamps from your CM will probably not match information from OPNsense. 1. Comcast sets the wrong time on the CM. 2. OPNsense is much more exact and comprehensive at reporting issues.

Edit: T3 and T4  time-out's should be from Comcast. In other words, nothing to do with OPNsense.

[relation]

I hope this does not add more confusion, but I do not think this is a completely simple issue as I think pseudonym3k has shown many valid points. It is a little complex. I do not understand every aspect of DNS, in relation to Kea, Unbound and DNSmasq, but trying to learn. But I do understand DNS, especially from a ms perspective. There is yet a fourth variable of "System: Settings: General:  DNS servers". And there is the complexity of disabling ISC correctly. So you are dealing with at least 4 variables, and one must decide on the strategy to use.

Personally, I started down the road of migrating from ISC to DNSmasq. But very quickly decided I did not like the combination of DHCP and DNS (not recursive) within DNSmasq. I do like that Kea = DHCP and Unbound (recursive) = DNS. In my mind, very simple and effective. [BTW, "System: Settings: General:  DNS servers" is blank. I use Cloudflare DoT, within Unbound, NOT my ISP DNS].

I guess I can only describe how my setup has met my requirements, and then see if it matches another user.
"Services: Dynamic DNS" = dynamic wan ip resolution, if the ISP changes my wan ip.
"Services: Unbound DNS: DNS over TLS" = security (without pi-hole, ad-guard, etc.)
"Services: Kea DHCP: Kea DHCPv4 AND v6" = Add static reservation for local hostname resolution does work (AFTER a restart of Unbound)

But there is this issue of MY statement of "AFTER a restart of Unbound" is in conflict with pseudonym3k comment "all sites are immediately found by DNS name again".
When I went through this exercise, one had to be very precise in terms of what was disabled or enabled and what service was restarted, and when. For example, if I did not restart Unbound at the right moment, local hostname resolution would fail. If I had to go through a fresh install again, I think I could do it, but no guarantees I could get it right on the first try.

So again, if you take actually 7 variables into account, and decide on a plan, although complex, the end result is rewarding.
ISC - disabled? correctly?
"Services: Dynamic DNS"
"System: Settings: General:  DNS servers" - blank?
Kea versus DNSmasq (one or the other, not both) (If DNSmasq, is port forward set correctly to 5353?)
Unbound - all settings.
"Services: Router Advertisements" (IPv6)
(someone may argue the order of this list, which would be welcome)

I think pseudonym3k brought up a real world experience. Again, hope this helps and does not add more confusion.

One afterthought. Please do not use a common address of 192.168.1.0/24 for your LAN. Needs to be more unique, in my opinion. Not implying this has anything to do with the topic, just a suggestion.

Is there a firewall service active on the windows workstation? Do you see anything in:
Firewall: Log Files: Live View

By "DNS name", do you mean local hostname? And you are using ping to test? Running "ipconfig /all", have you confirmed the client is using the local ip of the router for DNS?

I use Unbound and Kea only. To guarantee local hostname resolution (IPv4 and 6), I add a reservation for only the machines I need to resolve. Then, I just restart the Unbound service once and it works.

"Register ISC DHCP4 Leases" is disabled, as well as the ISC service. Attached are the Unbound settings.

Your RTT looks very high. My value is less than 20ms. High WAN Traffic, see "Reporting: Health" can cause RTT to go up. What where the values from OpenWRt?

In your Client config file, did you add "DNS = ..."? The Peer generator allows for this entry as well. You can also add a search domain such as:
"10.10.1.1, internal"
Not tested in generator, but works on Client config file.

Yes, create a normalization rule.