OPNsense 25.7.6-amd64 update changes to Live View

[doomsday]

Dear Opnsense team,
Regarding the last update 25.7.6 i have observed a change in live view , there is missing Direction (IN/OUT) collumn and what is more confusing, opnsese start to log OUT connection mostly generated from automated rule creation "let out anything from firewall host itself" - this two things gives bad visibility.

Before update:
OUT traffic was not shown if there wasn't created any rule to OUT manually.
After update:
OUT traffic is seen by automated generate rule witch cant be unchecked for monitoring.

Possible correction:
Add direction to live view as it was before, add uncheck monitoring for automated generate rules, add like before if no OUT was added to rules manually live view don't show OUT traffic.

I appriciate your work, Opnsense firewall outstanding so far !
BR

[franco]

Hi,

I'm not sure what you mean: the frontend was changed, but you talk about the backend reading the actual log differently than before? All the entries that are in the log should be shown in the GUI.


Cheers,
Franco

[doomsday]

I'm talking about frontend and visiblity, i attached picture :

[franco]

If you want the column there's probably a way to add it (or add it back).

> Before update:
> OUT traffic was not shown if there wasn't created any rule to OUT manually.
> After update:
> OUT traffic is seen by automated generate rule witch cant be unchecked for monitoring.

The premise seems wrong to me as stated: the rules and lines generated come from the log file, which do not change in the frontend rework.


Cheers,
Franco

[pfry]

I believe this refers to the lack of a "dir" column in the live log display. I didn't notice this, as I mostly read the "Label" column to determine rule match. The "dir" filter works (against "is" "in"/"out"). Sigh - new issue: the filter does not display properly. It's still operational, but the "bubble" is completely blank. I'll mention that in the other thread (25.7.6 "Firewall: Log Files: Live View" delayed response on "Auto-refresh").

[doomsday]

If you want the column there's probably a way to add it (or add it back).

> Before update:
> OUT traffic was not shown if there wasn't created any rule to OUT manually.
> After update:
> OUT traffic is seen by automated generate rule witch cant be unchecked for monitoring.

The premise seems wrong to me as stated: the rules and lines generated come from the log file, which do not change in the frontend rework.


Cheers,
Franco

Thats sound fair DIR column was basically essential,
Regarding logs, so this means log have those OUT entry from automatic generate rules that i can't stop flooding unless i add filter in live view every-time i open this window , maybe i could ask on github for a feature "disable monitoring for automatic created rules by interface".

[pfry]

Thats sound fair DIR column was basically essential,
Regarding logs, so this means log have those OUT entry from automatic generate rules that i can't stop flooding unless i add filter in live view every-time i open this window , maybe i could ask on github for a feature "disable monitoring for automatic created rules by interface".

They appear in the live view if logging is enabled ("Firewall: Settings: Advanced" -> "Logging").

There are configuration options. I posted about such. This does affect logging (I'm not sure I like that characteristic), so perhaps you want a template...

As for an enhancement, perhaps persistent views (e.g. column widths, template, etc.). As for the "Template": you can set up filters and save them (that's apparently the order of operations: create filters, hit the ">>", name the template, hit the save button, and there you go).

Are the "Active filters:" blank for you, too?

[doomsday]

Thank you so much, i found it and im not sure why this was enable after update. Please close this as the soultion is :

Firewall -> Advanced -> Logging
 Default pass    uncheck Log packets matched from the default pass rules

Now i don't even care about DIR column in live view.

BR