FreeBSD 14 – ipfw policy accidentally blocks production traffic – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Critical application ports become unreachable after ipfw reload, causing service interruption.

Environment & Reproduction

Seen when deny-all rules are introduced without explicit pass exceptions.

service ipfw start
ipfw list
ss -ltn

Root Cause Analysis

Rule ordering places blocking directives before required service allowances.

Quick Triage

Identify dropping rules and affected ports quickly from counters.

ipfw -d show
ipfw list | tail -n 20
netstat -an | grep LISTEN

Step-by-Step Diagnosis

Trace packet path against active ruleset and incrementing deny counters.

ipfw show
ipfw list | sed -n '1,120p'
tcpdump -ni any host 203.0.113.10 -c 50

Solution – Primary Fix

Add explicit pass rules for required services before deny directives.

ipfw add 100 allow tcp from any to me 22 in
ipfw add 110 allow tcp from any to me 443 in
service ipfw save 2>/dev/null || true

Solution – Alternative Approaches

Migrate to pf for clearer policy semantics if operational tooling standardizes on pf.

sysrc firewall_enable="NO"
sysrc pf_enable="YES"

Verification & Acceptance Criteria

Remote checks confirm required ports are reachable and deny counters stabilize.

nc -zv 127.0.0.1 22
nc -zv 127.0.0.1 443
ipfw -d show | head

Rollback Plan

Reload last known-good firewall script if new rules introduce exposure or outages.

sh /root/ipfw-last-good.rules
ipfw list

Prevention & Hardening

Use staged firewall policy tests and mandatory review for production changes.

ipfw -n /etc/ipfw.rules 2>/dev/null || true

Related Errors & Cross-Refs

Associated with asymmetric routing, NAT conflicts, and accidental interface scope mistakes.

Related tutorial: View the step-by-step tutorial for FreeBSD 14.

View all FreeBSD 14 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

FreeBSD ipfw handbook and firewall policy management guidance.