Messages

I have looked into "Firewall -> Settings -> Advanced"

There are two new options which seems new to me (they're also in English and not translated into German as this my language as default).

Disable RFC4890 requirement rules
Disable port 0 block

Both options are not set in my case, so rules are created. All default logging options are disabled.

So maybe in this two settings the log options are not respected? (just a wild guess)

Mine look like this (mac address shorted)

2026-07-16T09:34:52 Informational filterlog,,,0,vtnet1,normalize,pass,out,6,0xc0,0x00000,254,ipv6-icmp,58,32,fe80::22,fe80::short,datalength=32
2026-07-16T09:32:41 Informational filterlog,,,0,vtnet1,normalize,pass,out,6,0xc0,0x00000,254,ipv6-icmp,58,32,fe80::22,fe80::short,datalength=32
2026-07-16T09:20:31 Informational filterlog,,,0,vtnet2,ip-option,block,in,6,0x00,0x00000,1,ip,0,36,::,ff02::16,INVALIDOPT

I've upgraded my system to OPNsense 26.7.r2_3-amd64 and noticed the following Blocked Firewall Logs without any Label after every reboot:

WG Out 2026-07-12T09:25:39 IP :: ff02:16 block
WG Out 2026-07-12T09:25:38 IP :: ff02::16 block
WAN Out 2026-07-12T09:25:29 IP :: ff02::16 block
WAN Out 2026-07-12T09:25:28 IP :: ff02::16 block

I can confirm this. With current 26.7 I can see this messages for all interfaces at startup.  Later on I can see allow messages from WAN from fe80::22 (connect with ONT Modem and DHCPv6). All my rules have labels and rules are made in this way that I can see only blocks, everything else is not logged. It has worked until latest 26.1 version, know I see this.

The easiest fix would be to add "preserve" to both options, so you can individually update A and AAAA without deleting the other one.
I use the native backend, not sure if ddclient haves different

@meyergru
This is the reason I can't use it at the moment. I need this (I'm behind CGNAT connection and use a VPS for the ipv4 connection)
If you only update AAAA at desec.io and use os-ddclient, A Record will be deleted.

There's a API command at desec.io for this (perserve A Record) but it's not implemented in os-ddclient / opnsense.

As far as I know it's the same situation as before.

But I would also like to see this one fixed!