Upgraded from 3.12 to 4.6 and spoof_source stopped working

[AUnixman]

I have another box that I send logs to here and I have this in my syslog-ng.conf:

destination devsyslog { udp("192.168.50.46" spoof_source(yes)); };

This worked on my 3.12 build on FreeBSD 12.3, but sending to that destination fails now with the 4.6 build on FreeBSD 13.3 after upgrading. As in nothing goes out:

syslog-ng-ctl stats | grep devsyslog

destination;devsyslog;;a;processed;0
dst.udp;devsyslog#0;udp,192.168.50.46:514;a;eps_last_24h;0
dst.udp;devsyslog#0;udp,192.168.50.46:514;a;msg_size_max;0
dst.udp;devsyslog#0;udp,192.168.50.46:514;a;memory_usage;0
dst.udp;devsyslog#0;udp,192.168.50.46:514;a;dropped;0
dst.udp;devsyslog#0;udp,192.168.50.46:514;a;queued;0
dst.udp;devsyslog#0;udp,192.168.50.46:514;a;written;0
dst.udp;devsyslog#0;udp,192.168.50.46:514;a;eps_last_1h;0
dst.udp;devsyslog#0;udp,192.168.50.46:514;a;truncated_bytes;0
dst.udp;devsyslog#0;udp,192.168.50.46:514;a;msg_size_avg;0
dst.udp;devsyslog#0;udp,192.168.50.46:514;a;truncated_count;0
dst.udp;devsyslog#0;udp,192.168.50.46:514;a;processed;0
dst.udp;devsyslog#0;udp,192.168.50.46:514;a;eps_since_start;0

My guess is a syntax change, but I can't find a doc for this. Help? TIA!

(Added after more testing: if I remove spoof_source(yes) the traffic flows again. It only fails to send with spoof_source(yes) added. Unfortunately I need that.)

syslog-ng --version

syslog-ng 4 (4.6.0)
Config version: 4.2
Installer-Version: 4.6.0
Revision:
Compile-Date: Mar 5 2024 16:02:35
Module-Directory: /usr/local/lib/syslog-ng
Module-Path: /usr/local/lib/syslog-ng
Include-Path: /usr/local/share/syslog-ng/include
Available-Modules: http,json-plugin,add-contextual-data,affile,afprog,afsocket,afstomp,afuser,appmodel,azure-auth-header,basicfuncs,cef,confgen,cryptofuncs,csvparser,correlation,disk-buffer,examples,graphite,hook-commands,kvformat,linux-kmsg-format,map-value-pairs,metrics-probe,pseudofile,regexp-parser,secure-logging,stardate,syslogformat,system-source,tags-parser,tfgetent,timestamp,xml,rate-limit-filter
Enable-Debug: off
Enable-GProf: off
Enable-Memtrace: off
Enable-IPv6: on
Enable-Spoof-Source: on
Enable-TCP-Wrapper: off
Enable-Linux-Caps: off
Enable-Systemd: off

freebsd-version -kru

13.3-RELEASE
13.3-RELEASE
13.3-RELEASE

[AUnixman]

Update: This may be a firewall blocking spoofed addresses problem, not the application. I will follow-up once we determine that.

[AUnixman]

Confirmed as a firewall block, not syslog-ng.

Context: In the two+ years since I last needed the spoofed address forwarding the firewall was replaced by our network team, so new rules had to be added to the new firewall.

[bazsi]

thanks for getting back to us with this information.