FreeBSD 14 – pf rule set unintentionally blocks SSH management access

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Administrators lose inbound SSH access after firewall reload. Remote recovery becomes risky and may require console access.

Environment & Reproduction

Occurs after pf.conf edits, macro changes, or table refresh automation.

service pf status
pfctl -sr
pfctl -sa | head -n 80

Root Cause Analysis

Rule order, quick actions, or state table behavior can bypass intended pass rules for management sources.

Quick Triage

Confirm sshd is healthy before changing pf policy.

service sshd status
sockstat -4 -l | grep :22
clog /var/log/security | tail -n 40

Step-by-Step Diagnosis

Inspect effective ruleset and packet counters to identify blocking rule.

pfctl -vvsr
pfctl -vvss | head -n 100
tcpdump -ni  port 22 -c 50

Solution – Primary Fix

Insert explicit management pass rule early and reload validated configuration.

cp /etc/pf.conf /etc/pf.conf.bak
vi /etc/pf.conf
pfctl -nf /etc/pf.conf
pfctl -f /etc/pf.conf

Solution – Alternative Approaches

Use temporary anchor or table-based allowlist during incident response.

echo 'pass in quick proto tcp from  to any port 22' | pfctl -a emergency -f -
pfctl -a emergency -sr

Verification & Acceptance Criteria

SSH login from management source succeeds and no unintended broad exposure is introduced.

ssh -o BatchMode=yes admin@ true
pfctl -vvsr | grep -n 'port = 22'

Rollback Plan

Reload last known-good pf.conf if new policy introduces additional traffic impact.

pfctl -f /etc/pf.conf.bak
pfctl -sr

Prevention & Hardening

Require pf syntax and dry-run checks in deployment pipeline.

pfctl -nf /etc/pf.conf
service pf check
logger -t pf 'ruleset validated'

Related Errors & Cross-Refs

Commonly co-occurs with NAT translation changes and table refresh races.

Related tutorial: View the step-by-step tutorial for FreeBSD 14.

View all FreeBSD 14 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

pf.conf manual, OpenBSD PF design notes, and FreeBSD firewall operational guidance.