26.7.1_1 Firewall logging behaviour i don't understand

[SchengFui]

Hi there,

in Firewall: Settings: Advanced all of the following options are set to disabled:   

 Default block       Log packets matched from the default block rules
 Default pass       Log packets matched from the default pass rules
 Outbound NAT       Log packets matched by automatic outbound NAT rules
 Bogon networks       Log packets blocked by 'Block Bogon Networks' rules
 Private networks    Log packets blocked by 'Block Private Networks' rules

nevertheless the firewall creates entries from rule "Default allow LAN to any rule":

LAN In 2026-07-28T09:51:18 PGM xxx.xxx.xxx.xxx 234.1.1.2 block Default allow LAN to any rule

and why is it logging blocks for an allow-rule?

Could someone please help me to understand this behaviour?

thank you.

[meyergru]

The "Default allow LAN to any rule" is an automatically created rule for your first LAN. Other than that, it is then handled like any other manual rule, i.e. it can have logging enabled or disabled.

The settings in Firewall:Settings:Advanced are for rules "behind the scenes" which are not part of your own rule set and which - apart form some checkboxes - cannot be manipulated from your own ruleset.

I cannot say why this log entry was created, however, there is a small info button on the right of each log line (at least in the live log), if you click on it, you will see the details. Within those details, you will find a link to the "rid" (aka rule id), which gives you the precise rule that led to this log entry.

[SchengFui]

the rid points to a rule named "Default allow LAN to any rule", in this rule the action is "pass" and logging is disabled...

i still don't understand, why there are blocks logged with reference to "Default allow LAN to any rule"

[Patrick M. Hausen]

Whenever you change rules the ids used by the pf itself and logging can get out of sync. This has been discussed in a couple of threads. I don't quite remember if clearing all firewall states fixes that problem, but probably that is the case.

[SchengFui]

unfortunately resetting "state table" and "source tracking" under "Firewall: Diagnostics: States" changed nothing, logs are still generated.

this behaviour startet right after the update from 26.1.11_10 to 26.7.1_1

[SchengFui]

so i upgraded another OPNSense-Installation. Same upgrade-path from 26.1.11_10 to 26.7.1_1

before upgrading i migrated all legacy firewall-rules and deleted them

after the upgrade the logging starts immediately as on the other OPNSense.

on both OPNSense i see this only with PGM-Protocol, maybe it's a bug with PGM-Protocol, not in general with firewall rules...

[pfry]

How reliable is Firewall:Diagnostics:States for troubleshooting