Since Update, seeing INVALIDOPT entries in the firewall log

[IsaacFL]

I have started seeing a new entry in the firewall, since updating to 26.7.

Code Select Expand

,,,0,vtnet2,ip-option,block,in,6,0x00,0x00000,1,ip,0,56,::,ff02::16,INVALIDOPT
vtnet2 in my main user lan in this case but have seen on other vlans also.

There is no label in the entry in the Live log. Just protocol IP being blocked with source :: and Destination ff02::16

I have also seen a similar entry but ICMP with same source and destination.

Code Select Expand

,,,0,vtnet4,ip-option,block,in,6,0x00,0x00000,1,icmp,1,56,::,ff02::16,truncated-ip6=56
This is new since the update, and logging is disabled on the default rules.

I am running opnsense virtualized on proxmox.

[pfry]

There is a bit of discussion over at Netgate. As far as I can tell the action appears to be correct (scrub rule); the logs could be a behavior change in pf.

[IsaacFL]

There is a bit of discussion over at Netgate. As far as I can tell the action appears to be correct (scrub rule); the logs could be a behavior change in pf.

I believe they should be blocked also, just strange showing in logs.  I thought it might be hardware related and migrated my opnsense VM last night to a different proxmox node, and I still saw them occasionally overnight. Not a huge number in the log so can live with it.