FreeBSD 13 – PF Rules Not Loaded at Boot – Firewall Persistence Repair

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Expected firewall policy is missing after reboot, exposing services or blocking intended traffic.

Environment & Reproduction

Rules were loaded manually but not enabled for boot startup.

pfctl -sr
grep -E "pf_enable|pf_rules" /etc/rc.conf

Root Cause Analysis

PF service is disabled in rc.conf or points to invalid rules file path.

Quick Triage

Confirm pf status and syntax-check current ruleset file.

pfctl -si
pfctl -nf /etc/pf.conf

Step-by-Step Diagnosis

Audit startup configuration and boot-time firewall logs.

service pf onestatus
cat /etc/rc.conf
tail -n 120 /var/log/messages

Solution – Primary Fix

Enable PF permanently and reload validated rules.

sysrc pf_enable=YES
sysrc pf_rules=/etc/pf.conf
service pf restart

Solution – Alternative Approaches

Use ipfw if your environment standard mandates ipfw policy tooling.

Verification & Acceptance Criteria

Ruleset remains active across reboot and traffic policy behaves as intended.

reboot
pfctl -sr

Rollback Plan

Disable PF temporarily from console if lockout occurs and restore prior rules file.

pfctl -d

Prevention & Hardening

Validate rule syntax in CI and keep an out-of-band management access path.

Related Errors & Cross-Refs

pf not enabled, cannot load ruleset, syntax error in pf.conf.

Related tutorial: View the step-by-step tutorial for freebsd-13.

View all freebsd-13 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

pf.conf(5), pfctl(8), and FreeBSD firewall handbook sections.