ok looks like I found out what was going on, seems it was a rule left over from captive portal that I was playing with, and then uncheck to enable, so setting were still there but not enabled.
Seems this portion of filter.inc was creating the rules.
/* if captive portal is enabled, ensure that access to this port
* is allowed on a locked down interface
*/
if(is_array($config['captiveportal'])) {
foreach ($config['captiveportal'] as $cpcfg) {
$cpinterfaces = explode(",", $cpcfg['interface']);
$cpiflist = array();
$cpiplist = array();
foreach ($cpinterfaces as $cpifgrp) {
if(!isset($FilterIflist[$cpifgrp]))
continue;
$tmpif = get_real_interface($cpifgrp);
if(!empty($tmpif)) {
$cpiflist[] = "{$tmpif}";
$cpipm = get_interface_ip($cpifgrp);
if(is_ipaddr($cpipm)) {
$carpif = link_ip_to_carp_interface($cpipm);
if (!empty($carpif)) {
$cpiflist[] = $carpif;
$carpsif = explode(" ", $carpif);
foreach ($carpsif as $cpcarp) {
$carpip = find_interface_ip($cpcarp);
if (is_ipaddr($carpip))
$cpiplist[] = $carpip;
}
}
$cpiplist[] = $cpipm;
}
}
}
if (count($cpiplist) > 0 && count($cpiflist) > 0) {
$cpinterface = implode(" ", $cpiflist);
$cpaddresses = implode(" ", $cpiplist);
$portalias = $cpcfg['zoneid'] + 1;
$portalias .= " {$cpcfg['zoneid']}";
$ipfrules .= "pass in {$log} quick on { {$cpinterface} } proto tcp from any to { {$cpaddresses} } port { {$portalias} } keep state(sloppy)\n";
$ipfrules .= "pass out {$log} quick on { {$cpinterface} } proto tcp from any to any flags any keep state(sloppy)\n";
}
}
}
this was the rule that was setup
$ipfrules .= "pass out {$log} quick on { {$cpinterface} } proto tcp from any to any flags any keep state(sloppy)\n";
But I did not have captive portal enabled – I had create it in the passed and then unchecked it from being enabled.. But seems the rules were not deleted? I removed it, and then rebooted and how that rule is no longer there and not logging that traffic ;)
I can try and duplicate it to see if can regenerate the issue.
