Upgrades into RC1 via 26.1.11 opnsense-devel

[franco]

Labels are off due to a kernel error but we found the problem already, see https://github.com/opnsense/src/issues/295

[Wrigleys]

Labels are off due to a kernel error but we found the problem already, see https://github.com/opnsense/src/issues/295

Great, thanks for that!

[Wrigleys]

Labels are off due to a kernel error but we found the problem already, see https://github.com/opnsense/src/issues/295

Hi Franco,
Sorry for this follow-up. I assume that this issue has deen fixed and implemented in the new 26.7 kernel but unfortunate, I'm still seeing FW-Logs without Label after every reboot. I've upgraded my appliance from RC2 to 26.7 this morning.

Thanks and regards,
Wrigleys

[franco]

Do these rules have descriptions? If they don't have descriptions there will be no label correlation.

[Wrigleys]

In my case all rules have descriptions. For automatic generated rules and for my manually added rules. I think that those label-less rules are proceeded in the background. Could it be from kernel-/pf-internal filter rules?

Response from ChatGPT:
If the entries:

• only occur during boot,
• appear only once or twice per restart,
• have the destination ff02::16,
• and never reappear until the next reboot,

then they are most likely related to the initialization of the IPv6 networking stack. During startup, FreeBSD/OPNsense registers multicast group memberships on active interfaces using MLDv2 (Multicast Listener Discovery v2). The IPv6 multicast address ff02::16 is specifically reserved for all MLDv2-capable routers.

The fact that the source address is shown as :: (the IPv6 unspecified address) also fits the startup phase of an interface, before a normal IPv6 address has been fully configured. IPv6 control protocols can legitimately use special addresses during initialization.

The upgrade to OPNsense 26.7 (which is based on FreeBSD 15.1) likely changed how these packets are logged or made them visible in the firewall log. The underlying behavior itself is probably not new.

Conclusion
Based on the symptoms you described, these log entries look like normal IPv6/MLDv2 startup traffic generated during interface initialization. The upgrade likely made the packets visible in the logs, but there is no indication of an actual networking or security problem.

[Ampfinger]

I've upgraded my system to OPNsense 26.7.r2_3-amd64 and noticed the following Blocked Firewall Logs without any Label after every reboot:

WG Out 2026-07-12T09:25:39 IP :: ff02:16 block
WG Out 2026-07-12T09:25:38 IP :: ff02::16 block
WAN Out 2026-07-12T09:25:29 IP :: ff02::16 block
WAN Out 2026-07-12T09:25:28 IP :: ff02::16 block

I can confirm this. With current 26.7 I can see this messages for all interfaces at startup.  Later on I can see allow messages from WAN from fe80::22 (connect with ONT Modem and DHCPv6). All my rules have labels and rules are made in this way that I can see only blocks, everything else is not logged. It has worked until latest 26.1 version, know I see this.

[Wrigleys]

I'm still seeing those Label-less blocked filter rules even after installing 26.7 from scratch.

For testing purposes, I've enabled all logs under Firewall - Advanced but those few Label-less blocked filter rules are still there after a reboot.

It looks like a backend kernel-/pf-internal filter rules, which we unfortunately can't handle.

[franco]

Can you grab the relevant entries from the firewall plain log?