FreeBSD 12 – Common Problem 005 – pf Firewall Blocks Legitimate Outbound Traffic

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Applications cannot reach external endpoints despite local network being up.

Environment & Reproduction

After policy edits, outbound HTTPS and DNS traffic are denied by default rules.

Root Cause Analysis

Rule order or missing `pass out quick` statements causes broad egress drops.

Quick Triage

Check pf status and active rules.

service pf status
pfctl -sr
pfctl -si

Step-by-Step Diagnosis

Trace blocked flows and evaluate rule counters.

tcpdump -ni pflog0
pfctl -vvsr
netstat -rn

Solution – Primary Fix

Update `/etc/pf.conf` with explicit outbound pass rules and reload.

pfctl -nf /etc/pf.conf
service pf reload
pfctl -sr | head

Solution – Alternative Approaches

Temporarily disable pf for emergency restore only under approved change control: `service pf stop`.

Verification & Acceptance Criteria

Outbound DNS/HTTPS succeeds and `pflog0` no longer records expected allowed traffic.

Rollback Plan

Reapply previously known-good `/etc/pf.conf` and reload rules.

Prevention & Hardening

Version-control rules, test with `pfctl -nf`, and require peer review for policy changes.

Related Errors & Cross-Refs

`Operation timed out`, blocked entries in `pflog0`, missing state table entries.

Related tutorial: View the step-by-step tutorial for freebsd-12.

View all freebsd-12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

`pf.conf(5)`, `pfctl(8)`, FreeBSD firewall chapter.