FreeBSD 15 – IPFW and PF Enabled Together Causes Policy Conflict – Unified Firewall Strategy

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Traffic behavior is inconsistent because two packet filter frameworks enforce overlapping rules.

Environment & Reproduction

Host has both PF and IPFW enabled in rc.conf.

sysrc -a | grep -E "pf_enable|firewall_enable"
service pf onestatus
service ipfw onestatus

Root Cause Analysis

Rule precedence and duplicate filtering policies produce unexpected pass/drop outcomes.

Quick Triage

Identify which firewall stack is intended standard for this host role.

Step-by-Step Diagnosis

Capture active PF and IPFW rules to map conflicting controls.

pfctl -sr
ipfw list

Solution – Primary Fix

Disable non-standard firewall engine and keep one authoritative policy set.

sysrc firewall_enable=NO
service ipfw stop
service pf restart

Solution – Alternative Approaches

Migrate to IPFW only if organizational standards and tooling require IPFW.

Verification & Acceptance Criteria

Traffic policy is deterministic across reloads and reboots.

reboot
pfctl -si

Rollback Plan

Restore previous engine enablement if application connectivity fails under new policy.

Prevention & Hardening

Define a single firewall ownership standard in baseline configuration.

Related Errors & Cross-Refs

unexpected packet drops, duplicate firewall controls, policy mismatch.

Related tutorial: View the step-by-step tutorial for freebsd-15.

View all freebsd-15 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

FreeBSD PF and IPFW administration references and migration guides.