firewall allowing WAN to connect to Google DNS servers

[Fright]

I am only allowing the DNS to the opnsense server.

no.
you allow all traffic by "allow iot to any rule". you can try to enable logging on this rule and check logs

Which brings me back to the question, why can't I disable/delete the auto-generated rules?

why do you want to block the request when it is already trying to exit the WAN? block on ingress interface: just block dns-traffic from iot-network to any except "this firewall"

[tiermutter]

block on ingress interface: just block dns-traffic from iot-network to any except "this firewall"

I think the TS don´t want to just block DNS requests to WAN. He wants all DNS requests to be resolved by unbound, even if the devices have hardcoded DNS Servers.

[nferocious76]

I found Google APIs Client Library for PHP as part of the package php82-google-api-php-client.
Could this also be the cause?

[cookiemonster]

the "cause" of this was a misconfugration on the firewall rules.