FreeBSD 14 – pf ruleset blocks SSH after reload – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Remote administration is lost immediately after firewall reload, creating outage risk.

Environment & Reproduction

Occurs after editing /etc/pf.conf without explicit management allow rules.

service pf restart
pfctl -sr
ssh user@host

Root Cause Analysis

Rule order or default deny behavior blocks inbound port 22 before pass rule evaluation.

Quick Triage

Use console access to inspect active rules and counters.

pfctl -sr -v
pfctl -si
netstat -an | grep '.22 '

Step-by-Step Diagnosis

Test candidate ruleset syntax and identify which rule drops SSH packets.

pfctl -nf /etc/pf.conf
tcpdump -ni any port 22 -c 30
pfctl -vvsr | head -n 120

Solution – Primary Fix

Insert explicit management allow rule before block directives and reload pf.

cp -a /etc/pf.conf /etc/pf.conf.bak
awk 'NR==1{print "pass in on egress proto tcp from 198.51.100.0/24 to any port 22 keep state"}1' /etc/pf.conf.bak > /etc/pf.conf
pfctl -nf /etc/pf.conf && service pf reload

Solution – Alternative Approaches

Enable temporary fail-open maintenance policy with automatic rollback timer.

echo 'set skip on lo' > /tmp/pf-safe.conf
cat /etc/pf.conf >> /tmp/pf-safe.conf
pfctl -f /tmp/pf-safe.conf

Verification & Acceptance Criteria

SSH connections succeed from approved management networks and policy remains active.

ssh -o ConnectTimeout=5 [email protected]
pfctl -sr
pfctl -ss | head

Rollback Plan

Restore prior pf.conf backup and reload if new rule set affects production traffic.

cp -a /etc/pf.conf.bak /etc/pf.conf
service pf reload

Prevention & Hardening

Validate pf.conf in CI and enforce out-of-band access before firewall changes.

pfctl -nf /etc/pf.conf

Related Errors & Cross-Refs

Can overlap with routing asymmetry, CARP failover rules, and NAT misordering.

Related tutorial: View the step-by-step tutorial for FreeBSD 14.

View all FreeBSD 14 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

FreeBSD pf firewall guide and secure rule design practices.