Thanks, @stephenw10, @nedyah700, @sgc -- that worked!
For posterity :)
If you've been running in BYPASS MODE and want to get right back to it after a reinstall of pfSense and a restore of a backed-up configuration ...
1> Prepare a USB memstick:
https://docs.netgate.com/pfsense/en/latest/install/write-memstick.html
2> Choose your backup config file, make a copy, and rename the copy config.xml
3> Open config.xml in a text editor and change all references to pfatt.sh so they read like this: /root/pfatt/pfatt.sh
4> Put config.xml on the FAT partition on the memstick. Follow these instructions:
https://docs.netgate.com/pfsense/en/latest/backup/restore-during-install.html
5> Make a copy of your backup of pfatt.sh, open that copy in a text editor and make sure the values for ONT_IF, RG_IF, and RG_ETHER_ADDR are appropriate for your environment.
6> Copy the reviewed/edited copy of pfatt.sh to the root of the FAT partition on the memstick.
7> Install pfSense
https://docs.netgate.com/pfsense/en/latest/install/install-walkthrough.html
8> Near the end of the process, the installer will ask if you'd like to open a shell to make any final manual modifications. Answer yes.
9> These next commands will copy pfatt.sh from the memstick to the pfSense volume. They may not be 100% correct for all environments. Google will help you out 👍
mkdir -p /root/pfatt
mkdir -p /mnt/usb
mount -t msdosfs /dev/da0s3 /mnt/usb/
cp /dev/da0s3/pfatt.sh /root/pfatt/pfatt.sh
chmod -R 555 /root/pfatt
exit
10> Reboot your pfSense and profit.
Caveats:
In step 9, the FAT partition on my memstick was /dev/da0s3. Yours may be different. You can start by viewing the output of this command and (probably) appending 3 for the FAT partition. Google can get you the rest of the way if you need help.
camcontrol devlist
For some reason, my installer wouldn't pick up config.xml during the installation process, so, I left my memstick plugged in for the first reboot and used the computer's boot manager to start pfSense from the hard disk. The ECL took over and all was right in the world.
If you're running pfBlockerNG in Python mode, you may have to disable Python in the DNS resolver before your fresh system will download any packages .... including pfBlockerNG. You can re-enable Python mode after everything settles down.
I hope all this typing helps someone out of a bind some day :)
