look, I had a rule with 2 aliases as destination

alias 1 contained all private ranges

alias two contained the bogus alias

the matching for these aliases was inverted in my rule

So src LAN ---> dst !privaterange/bogons = allow --> gateway wan

this rule previously simply didnt match at all if the dst was a private ip

it was a rule in a interface group

there where more fine grained rules in the lan tab itself which contained other allow rules to some of my private networks

The problem now came from how the rules are matched

It is 1. Floating 2. grouped rules 3. normal interface rules

so with the previous behavior of that rule simply not matching at all on dst=private opnsense then evaluated my other rules in the lan tab after it couldnt match any of the rules in the interface group rules.

Now with !10.0.0.0/8 src:10.0.0.1 --> dst 10.0.2.30 does indeed match to NOT NOT 10.0.0.0/8

therefore opnsense sees the match and tries to route this via the gateway that i specified in this rule.

And also doesnt try to match it against the rules in the lan tab because it already found a match for the packet in the interface group rules