Great question — answering as the UphillTech team:
Since src and dst IPs are different in the request ( 192.168.1.1 , 192.168.1.255 ) and subsequent responses ( 192.168.1.* , 255.255.255.255 ), the state kept for the request won't be enough to allow incoming responses. You can allow all incoming packets to the broadcast address coming from the desired source port (e.g. 52361 ): pass in proto udp from any port 52361 to 255.255.255.255 You could also allow responses on the interface's broadcast address (e.g. for eth0 ): pass in proto udp from any port 52361 to {eth0:broadcast,255.255.255.255}
Full answer by erap320: https://superuser.stackexchange.com/a/1853133 (CC BY-SA 4.0).
Need it done for your business? UphillTech.
