Bizarre problem out of the blue. One client blocked.

[poodad]

This is truly bizarre. Out of the blue yesterday morning, one client started being blocked from Internet by the "Default Deny / Policy Violation" built-in rule when on wifi. On wifi, the client has access to everything on the local network including OPNSense management. I can change the client IP but the blocks persist.

The client is a Lenovo T440 laptop running Windows 10. OPNSense is 23.7.12-amd64. APs are Cisco 2702 in autonomous mode. Nothing has been updated recently or configs changed.

When I connect the client wired (same VLAN/ subnet), it works.

This setup had been running great for years.

For completeness, I will add this:

1. Several months ago, I added crowdsec to OPNSense. After a couple of months, crowdsec went berserk and blocked a couple of internal IP addresses (including my internal DNS server.) I disabled crowdsec.

2. I tried the 24.1 upgrade and it screwed up OPNSense. I run OPNSense on ESX, so I reverted to the pre update snapshot to get back to 23.7.

Both of these events happed weeks before this new issue started.

Any ideas? Have can I see exactly what policy violations are occurring in order to figure this out? I'm sure it must be in the logs somewhere, but I haven't found anything that looks like a smoking gun.