block events without Label? Firewall: Log Files: Live View

[vimage22]

I did a clean install to 26.7.3_11 and now see events in Live Log that did not seem to be there before. Is this normal? Without a label, there is no way to track the specific rule that triggered it?

[lmoore]

Looking at the list of automatically generated rules, it should be allowed.




[Edit] Rephrased response.

[vimage22]

Agreed, but then shouldn't this be displayed as the Label? "IPv6 RFC4890 requirements (ICMP)"

[lmoore]

Check setting for Disable RFC4890 requirement rules in Firewall -> Settings -> Advanced, is it unticked?

[vimage22]

All loggings settings in Advanced are unchecked. And this is how it was setup in older versions. So still puzzled why these appear.
Also, just realized the rule is set to Pass, not block.
And "Disable RFC4890 requirement rules" is unchecked.

Does this show anything interesting?

action    [block]
class      0x00
dir       [in]
dst      ff02::16
dsthostname   ff02::16
flow      0x00000
hoplimit   1
interface   bridge0
ipversion   6
label   
length      76
protoname   icmp
protonum   1
reason      ip-option
src      ::
srchostname   ::
status      2

[lmoore]

The OPNsense installation I've set up have had the Logging options in Firewall-Advanced enabled by default, with exception to Outbound NAT.

The reason line gives you a clue.

Extract from pf.conf(5)

allow-opts
      By  default, packets with IPv4 options or IPv6 hop-by-hop or destina-
      tion options header are blocked.  When allow-opts is specified for  a
      pass  rule,   packets  that  pass  the filter based on that rule (last
      matching) do so even if they contain options.  For packets that match
      state, the rule that initially created the state is   used.   The  im-
      plicit  pass  rule,   that  is  used   when a packet does not match any
      rules, does not allow IP options or option headers.   Note  that  IPv6
      packets with type 0 routing headers are always dropped.

[pfry]

I'd expect a log like that to be due to "Firewall: Settings: Normalization" -> "Disable interface scrub", also visible under "Firewall: Diagnostics: Statistics" -> "rules", "rules" -> "filter rules", usually the top entry. I believe you can allow options via rules: check "allow options" under "Advanced features".

[vimage22]

Disable interface scrub is un-checked. Needs to stay this way because I use Wireguard:
If checked, mss clamping will also be disabled

Under Edit rule: "advance mode"
Allow options:
Help Text: This allows packets with IP options to pass. Otherwise they are blocked by default.

I think this is getting closer to the answer. I do not have a problem with having this traffic blocked. Only that it shows up under Live View, and that it does not have a "Label". Maybe this was changed in FreeBSD [pf.conf(5)] and the event, which is valid, is bypassing the suppression in OPNsense? Just a guess.