PF NAT Stops Working After Interface Address Change

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

NAT rules tied to static addresses can break when WAN IP or interface names change.

Environment & Reproduction

Internal hosts lose outbound internet while local routing remains functional.

Root Cause Analysis

Routers and firewall hosts using pf with NAT and optional stateful filtering.

Quick Triage

Console access and backup firewall rules to prevent remote lockout.

Step-by-Step Diagnosis

[image_ref: 0] Run pfctl -sn; pfctl -sr; pfctl -ss | head; ifconfig -a; tcpdump -ni wan_if host test_destination.

Solution – Primary Fix

[image_ref: 1] Use interface macros and dynamic address forms in /etc/pf.conf rather than hard-coded IP addresses.

Solution – Alternative Approaches

Update interface macros, revalidate syntax with pfctl -nf, reload with service pf restart, and clear stale states if required.

Verification & Acceptance Criteria

Clients regain outbound connectivity and NAT translation counters increase as expected.

Rollback Plan

Reload previous pf.conf backup and temporarily bypass problematic NAT rule blocks.

Prevention & Hardening

Template pf rules for interface abstraction and validate after DHCP or provider changes.

Related Errors & Cross-Refs

Escalate if upstream ISP policy or asymmetric routing prevents return traffic.

Related tutorial: View the step-by-step tutorial for freebsd-14.

View all freebsd-14 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

pf.conf(5), pfctl(8), ifconfig(8), tcpdump(8).