If you want to filter the states by Rule ID you have to enter the rule numbers there. You can see the rule numbers in the running ruleset by running: pfctl -vvsr For example: [23.09.1-RELEASE][root@7100.stevew.lan]/root: pfctl -vvsr @0 scrub from any to <vpn_networks:*> fragment no reassemble [ Evaluations: 39420 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @1 scrub from <vpn_networks:*> to any fragment no reassemble [ Evaluations: 39420 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @2 scrub on lagg0 inet all fragment reassemble [ Evaluations: 39420 Packets: 39368 Bytes: 310545 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @3 scrub on lagg0 inet6 all fragment reassemble [ Evaluations: 1 Packets: 1 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @4 scrub on ix2 inet all fragment reassemble [ Evaluations: 51 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @5 scrub on ix2 inet6 all fragment reassemble [ Evaluations: 2 Packets: 2 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @6 scrub on lagg1 inet all fragment reassemble [ Evaluations: 49 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @7 scrub on lagg1 inet6 all fragment reassemble [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @0 anchor "openvpn/*" all [ Evaluations: 813 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @1 anchor "ipsec/*" all [ Evaluations: 813 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @2 block drop in log quick inet from 169.254.0.0/16 to any label "Block IPv4 link-local" ridentifier 1000000101 [ Evaluations: 813 Packets: 12 Bytes: 1152 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: Tue Jan 16 15:19:53 2024 ] @3 block drop in log quick inet from any to 169.254.0.0/16 label "Block IPv4 link-local" ridentifier 1000000102 [ Evaluations: 23 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @4 block drop in log inet all label "Default deny rule IPv4" ridentifier 1000000103 [ Evaluations: 23 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @5 block drop out log inet all label "Default deny rule IPv4" ridentifier 1000000104 [ Evaluations: 800 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @6 block drop in log inet6 all label "Default deny rule IPv6" ridentifier 1000000105 [ Evaluations: 801 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @7 block drop out log inet6 all label "Default deny rule IPv6" ridentifier 1000000106 [ Evaluations: 778 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @8 pass quick inet6 proto ipv6-icmp all icmp6-type unreach keep state ridentifier 1000000107 [ Evaluations: 4 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @9 pass quick inet6 proto ipv6-icmp all icmp6-type toobig keep state ridentifier 1000000107 [ Evaluations: 4 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @10 pass quick inet6 proto ipv6-icmp all icmp6-type neighbrsol keep state ridentifier 1000000107 [ Evaluations: 4 Packets: 1 Bytes: 72 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @11 pass quick inet6 proto ipv6-icmp all icmp6-type neighbradv keep state ridentifier 1000000107 [ Evaluations: 3 Packets: 1 Bytes: 72 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 1 ] [ Last Active Time: N/A ] @12 pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type echorep keep state ridentifier 1000000108 [ Evaluations: 2 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @13 pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routersol keep state ridentifier 1000000108 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @14 pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routeradv keep state ridentifier 1000000108 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @15 pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbrsol keep state ridentifier 1000000108 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @16 pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbradv keep state ridentifier 1000000108 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @17 pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type echorep keep state ridentifier 1000000109 [ Evaluations: 1 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @18 pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routersol keep state ridentifier 1000000109 [ Evaluations: 1 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @19 pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routeradv keep state ridentifier 1000000109 [ Evaluations: 1 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @20 pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbrsol keep state ridentifier 1000000109 [ Evaluations: 1 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @21 pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbradv keep state ridentifier 1000000109 [ Evaluations: 1 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @22 pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type echoreq keep state ridentifier 1000000110 [ Evaluations: 1 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @23 pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routersol keep state ridentifier 1000000110 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @24 pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routeradv keep state ridentifier 1000000110 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @25 pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbrsol keep state ridentifier 1000000110 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @26 pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbradv keep state ridentifier 1000000110 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @27 pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type echoreq keep state ridentifier 1000000111 [ Evaluations: 1 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @28 pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type routersol keep state ridentifier 1000000111 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @29 pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type routeradv keep state ridentifier 1000000111 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @30 pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type neighbrsol keep state ridentifier 1000000111 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @31 pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type neighbradv keep state ridentifier 1000000111 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @32 pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type echoreq keep state ridentifier 1000000112 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @33 pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routersol keep state ridentifier 1000000112 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @34 pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routeradv keep state ridentifier 1000000112 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @35 pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbrsol keep state ridentifier 1000000112 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @36 pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbradv keep state ridentifier 1000000112 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @37 pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type echoreq keep state ridentifier 1000000113 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @38 pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type routersol keep state ridentifier 1000000113 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @39 pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type routeradv keep state ridentifier 1000000113 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @40 pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type neighbrsol keep state ridentifier 1000000113 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @41 pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type neighbradv keep state ridentifier 1000000113 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @42 block drop log quick inet proto tcp from any port = 0 to any label "Block traffic from port 0" ridentifier 1000000114 [ Evaluations: 799 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @43 block drop log quick inet proto udp from any port = 0 to any label "Block traffic from port 0" ridentifier 1000000114 [ Evaluations: 753 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @44 block drop log quick inet proto tcp from any to any port = 0 label "Block traffic to port 0" ridentifier 1000000115 [ Evaluations: 797 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @45 block drop log quick inet proto udp from any to any port = 0 label "Block traffic to port 0" ridentifier 1000000115 [ Evaluations: 753 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @46 block drop log quick inet6 proto tcp from any port = 0 to any label "Block traffic from port 0" ridentifier 1000000116 [ Evaluations: 799 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @47 block drop log quick inet6 proto udp from any port = 0 to any label "Block traffic from port 0" ridentifier 1000000116 [ Evaluations: 2 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @48 block drop log quick inet6 proto tcp from any to any port = 0 label "Block traffic to port 0" ridentifier 1000000117 [ Evaluations: 2 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @49 block drop log quick inet6 proto udp from any to any port = 0 label "Block traffic to port 0" ridentifier 1000000117 [ Evaluations: 2 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @50 block drop log quick from <snort2c:0> to any label "Block snort2c hosts" ridentifier 1000000118 [ Evaluations: 799 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @51 block drop log quick from any to <snort2c:0> label "Block snort2c hosts" ridentifier 1000000119 [ Evaluations: 799 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @52 block drop in log quick proto tcp from <sshguard:0> to (self:11) port = ssh label "sshguard" ridentifier 1000000301 [ Evaluations: 799 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @53 block drop in log quick proto tcp from <sshguard:0> to (self:11) port = https label "GUI Lockout" ridentifier 1000000351 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @54 block drop in log quick from <virusprot:0> to any label "virusprot overload table" ridentifier 1000000400 [ Evaluations: 23 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @55 pass in quick on lagg0 proto udp from any port = bootps to any port = bootpc keep state label "allow dhcp replies in WAN" ridentifier 1000000461 [ Evaluations: 23 Packets: 2 Bytes: 656 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 1 ] [ Last Active Time: Tue Jan 16 14:11:54 2024 ] @56 pass out quick on lagg0 proto udp from any port = bootpc to any port = bootps keep state label "allow dhcp client out WAN" ridentifier 1000000462 [ Evaluations: 784 Packets: 4 Bytes: 1312 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 2 ] [ Last Active Time: Tue Jan 16 15:59:01 2024 ] @57 block drop in log on ! lagg0 inet from 172.21.16.0/24 to any ridentifier 1000001470 [ Evaluations: 796 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @58 block drop in log inet from 172.21.16.120 to any ridentifier 1000001470 [ Evaluations: 782 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @59 block drop in log on lagg0 inet6 from fe80::2e0:edff:fe86:a68c to any ridentifier 1000001470 [ Evaluations: 22 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @60 block drop in log on ! ix2 inet from 192.168.88.0/24 to any ridentifier 1000002520 [ Evaluations: 22 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @61 block drop in log inet from 192.168.88.1 to any ridentifier 1000002520 [ Evaluations: 22 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @62 block drop in log on ix2 inet6 from fe80::208:a2ff:fe0e:a593 to any ridentifier 1000002520 [ Evaluations: 22 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @63 pass in quick on ix2 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps keep state label "allow access to DHCP server" ridentifier 1000002541 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @64 pass in quick on ix2 inet proto udp from any port = bootpc to 192.168.88.1 port = bootps keep state label "allow access to DHCP server" ridentifier 1000002542 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @65 pass out quick on ix2 inet proto udp from 192.168.88.1 port = bootps to any port = bootpc keep state label "allow access to DHCP server" ridentifier 1000002543 [ Evaluations: 774 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @66 pass in on lo0 inet all flags S/SA keep state label "pass IPv4 loopback" ridentifier 1000004661 [ Evaluations: 794 Packets: 23 Bytes: 2226 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 11 ] [ Last Active Time: Tue Jan 16 13:59:27 2024 ] @67 pass out on lo0 inet all flags S/SA keep state label "pass IPv4 loopback" ridentifier 1000004662 [ Evaluations: 24 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @68 pass in on lo0 inet6 all flags S/SA keep state label "pass IPv6 loopback" ridentifier 1000004663 [ Evaluations: 26 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @69 pass out on lo0 inet6 all flags S/SA keep state label "pass IPv6 loopback" ridentifier 1000004664 [ Evaluations: 12 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @70 pass out inet all flags S/SA keep state allow-opts label "let out anything IPv4 from firewall host itself" ridentifier 1000004665 [ Evaluations: 796 Packets: 92 Bytes: 23856 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 13 ] [ Last Active Time: Tue Jan 16 15:41:40 2024 ] @71 pass out inet6 all flags S/SA keep state allow-opts label "let out anything IPv6 from firewall host itself" ridentifier 1000004666 [ Evaluations: 774 Packets: 2 Bytes: 172 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @72 pass out route-to (lagg0 172.21.16.1) inet from 172.21.16.120 to ! 172.21.16.0/24 flags S/SA keep state allow-opts label "let out anything from firewall host itself" ridentifier 1000004761 [ Evaluations: 774 Packets: 2338 Bytes: 448008 States: 3 ] [ Inserted: uid 0 pid 46270 State Creations: 743 ] [ Last Active Time: Tue Jan 16 16:37:23 2024 ] @73 pass in quick on ix2 proto tcp from any to (ix2:2) port = https flags S/SA keep state label "anti-lockout rule" ridentifier 10002 [ Evaluations: 796 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @74 pass in quick on ix2 proto tcp from any to (ix2:2) port = http flags S/SA keep state label "anti-lockout rule" ridentifier 10002 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @75 pass in quick on ix2 proto tcp from any to (ix2:2) port = ssh flags S/SA keep state label "anti-lockout rule" ridentifier 10002 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @76 anchor "userrules/*" all [ Evaluations: 796 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @77 pass in quick on lagg0 reply-to (lagg0 172.21.16.1) inet all flags S/SA keep state label "USER_RULE: Allow all ipv4+ipv6 via pfSsh.php" label "id:1533055761" ridentifier 1533055761 [ Evaluations: 796 Packets: 40 Bytes: 25177 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 10 ] [ Last Active Time: Tue Jan 16 16:04:08 2024 ] @78 pass in quick on lagg0 inet6 all flags S/SA keep state label "USER_RULE: Allow all ipv4+ipv6 via pfSsh.php" label "id:1533055761" ridentifier 1533055761 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @79 pass in quick on lagg0 reply-to (lagg0 172.21.16.1) inet proto icmp from <WAN__NETWORK:1> to 172.21.16.120 keep state label "USER_RULE: Allow ping" label "id:1559646116" ridentifier 1559646116 [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @80 pass in quick on ix2 inet from <LAN__NETWORK:1> to any flags S/SA keep state label "USER_RULE: Default allow LAN to any rule" label "id:0100000101" ridentifier 100000101 [ Evaluations: 26 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] @81 anchor "tftp-proxy/*" all [ Evaluations: 786 Packets: 0 Bytes: 0 States: 0 ] [ Inserted: uid 0 pid 46270 State Creations: 0 ] [ Last Active Time: N/A ] From the Firewall > Rules page in the GUI you can click on the state column for each individual rule and it will automatically fill in the RuleID in the state table filtering. Steve

@stephenw10 Done

@stephenw10 Thanks Steve, I'll open a ticket.

Ok so reviewing the thread are phone still failing to register when using 2.7 with IPSec enabled? Or is it just that calls fail? Either way look at the SIP traffic from a phone. Check the states and/or run packet captures. Where does it appear? Where doesn't it appear? Is it somehow going over the VPN?

Thanks @stephenw10 appreciate your help!

it didn't allow the picture in the first post, so here goes... [image: 1705352147175-48d57e1a-949e-49fc-92f2-1d7f96893a06-image.png]

Ok, have a look into the DOCSIS Telemetry. I was hell if my ISP rollout the OFDMA to the upstream some years ago. And your problem looks similar. Idle was nice, but if you use the bandwidth, the error rat grows and grows and with it the retransmission and the latency explode. It takes month and 2-3 construction sites to get a nice stable connection back. Have a look into it fist.

Yes that will pass TCP traffic from 192.168.88.39 to any device in the LAN subnet.

I would have to say it's more likely a rogue DHCP server stealing the IP address. That could be at 2 hour intervals. I would try checking the ARP table on a client when it stops and make sure it's still using the correct MAC address.

@stephenw10 Seems like changing ARP Cache TTL to 60 seconds fixed issue I was observing. Finally I have resolution to my issue such a relief.

Something must have changed. Maybe the app version? Can you test this behind some other device running pfSense CE to rule out something hardware specific? If this was breaking whatsapp calls for everyone there would be many, many threads!

How were you testing? From some internal device? That would require NAT reflection. But actual external connections would not.

Since traffic can still reach external sites I'd say more likely a rogue dhcp server.

@stephenw10 Started to work perfectly as soon as I set the outbound NAT! Thank you so much for your patience and your help! I've been using pfSense for quite some time now and I am slowly learning the ins and outs. Unfortunately sometime when I come to the forum the responders to my questions imply I'm an idiot for asking a question and that it is sorely lacking any relevant information. I guess they don't know we all have to start somewhere and if I was as smart as I should be I wouldn't be asking any questions! Thanks again for your help.

@zedbra That was an issue that cropped up a while ago. That’s basically the fix. https://redmine.pfsense.org/issues/13132

Yes the gateway is almost always inside the WAN subnet so most of the IP address will be the same.

@michmoor said in netflow and graylog: Few things ive been able to do with GROK parsing is not to clean up my unbound log files and create fields that are important to me and good for tracking. I'm running Graylog 5.2 now, had to build gcc 11.1.0+ from source, it took a few hours in my raspberry pi 4 but it is working :) @michmoor said in netflow and graylog: I just dont know how to enrich data using dns for IP lookups but thats ok I'm using PTR for that purpose, if there is something I can help, just let me know. @michmoor said in netflow and graylog: Few things ive been able to do with GROK parsing is not to clean up my unbound log files and create fields that are important to me and good for tracking. Ow, that is really nice :) If it is possible, can you share how you are getting those statistics from Unbound ?

@NollipfSense I know. Ours is set to reject. We hardly see any spam at all.

@coxhaus said in PFsense hardware recommendation HELP!: Why 12th gen? Is the CPU instruction set that much different? It was the OP's choice and I just affirmed...