Why does OPNsense send syslog events to targets via its WAN interface?

[mzaghouani]

Hello,

I have configured a syslog target in OPNsense which is located in its local network. Then I mentionned that there are many blocks against syslog trafic which is sourced from the OPNsense WAN interface. Those blocks are coming from the default deny rule on incoming trafic to the WAN interface. When I verify the logging/target configuration on OPNsense, there is no parameters about the source address that OPNsense should use when sending syslog messages.
If anyone could answer the question why does OPNsense send syslog events to targets via its WAN interface?
is there any possibility to change it to another interface (local interface)?

[cookiemonster]

Can you tell the destination ip setup to send to and an example of the block?