PF Rules Accidentally Block Outbound Traffic

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Server can be reached inbound but cannot fetch updates or reach external APIs.

Environment & Reproduction

Default block policy without pass out rule, wrong interface macro, or table mismatch.

Root Cause Analysis

Run pfctl -sr and pfctl -si to confirm active rules and packet drops.

Quick Triage

Temporarily load a known-good ruleset and allow essential outbound DNS and HTTPS.

Step-by-Step Diagnosis

Check current counters with pfctl -vvsr and test connectivity after each ruleset load.

Solution – Primary Fix

Review /etc/pf.conf and pflog output using tcpdump -n -e -ttt -r /var/log/pflog.

Solution – Alternative Approaches

Define interfaces and networks explicitly, add pass out keep state, validate with pfctl -nf /etc/pf.conf, then reload.

Verification & Acceptance Criteria

Confirm pkg update and outbound curl requests succeed while inbound policy remains enforced.

Rollback Plan

Version pf.conf and run syntax checks before enabling with pf_enable=”YES” via sysrc.

Prevention & Hardening

Reload previous firewall ruleset from backup and disable temporary changes.

Related Errors & Cross-Refs

Escalate if traffic loss persists with known-good rules, indicating NIC or routing faults.

Related tutorial: View the step-by-step tutorial for freebsd-15.

View all freebsd-15 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

pfctl -nf /etc/pf.conf; pfctl -f /etc/pf.conf; pfctl -sr; sysrc pf_enable=”YES”