Good FreeBSD question — answering as the UphillTech team:
As expected, I was doing something wrong. An earlier rule I had was to allow full LAN access: 100 allow ip from 192.168.68.0/24 to any Because of the any as the target instead of the CIDR, it was catching all traffic, and because it's not keeping state that the subsequent comms between my machine and the remote server were getting axed. To fix this I used a variable to store the CIDR: lan="192.168.68.0/24" And then modified the 100 rule to ensure it only captured local communications: 100 allow ip from $lan to $lan With that not capturing my other requests I could then also modify my 360 rule...
Full answer by Matt Lacey: https://unix.stackexchange.com/a/807611 (CC BY-SA 4.0).
Need help with this? UphillTech.