Messages in firewall log without a source rule

[mooh]

Today I noticed that the firewall log of one of my OPNsense 26.10-amd64 FWs contains messages as shown in the screenshot. The label field and rid are empty, just like messages from rules that had their logging turned off afterwards. But these continue to be produced at ~1h intervals and I have failed to identify a matching rule, manual or automatic, with or without logging.

I noticed however, that these messages only appear on 2 VLANS that also happen to use os-ndp-proxy-go. I had the chance to disable the proxy on Skynet and the messages stopped. They returned when the proxy was re-activated. I don't consider this a proof and will investigate this further.

[Monviech (Cedrik)]

Interesting.

The ndp proxy does not interact much with PF, it opens BPF listeners and copies frames directly, circumventing pf for the NDP and RA packets it proxies (which are IPv6-ICMP). Whatever is logged there, if you find out where it comes from, let me know.