Then the prayer:
He wrote his post-mortem at dawn. Title: "PF_CONFIG_VERSION vs. PF_PROGRAM_VERSION: A Case of Silent Deprecation."
His stomach turned to ice. Current. Not -release . Not -stable . Someone—a junior with a cowboy hat and a cron job—had pointed their package repository to the bleeding-edge snapshots. And the new PF, the one in 7.5-current , had changed. pf configuration incompatible with pf program version
He pulled up the man page on his laptop. pf.conf(5) . There it was, buried in the "Migration Notes" for 7.5: The from <list> syntax has been deprecated for non-route-related filter rules. Use an anchor or table for multiple source prefixes. Direct lists in a pass in rule will now raise a fatal syntax error. A fatal error. Not a warning. Not a "this might break." A stone-cold, refuse-to-start fatal error.
pfctl -sr | grep "api_sources"
gw-04-dfw wasn't just in a backup state. It was a naked machine on the public internet, its interface wide open.
The old PF (the one running on 7.4) had been lenient. It saw the curly braces, expanded the list in memory, and carried on. The new PF was a stricter grammarian. It saw the same syntax, declared it heresy, and refused to load any rules at all. Zero firewall. No state table. No blocking. No logging. Then the prayer: He wrote his post-mortem at dawn
Silence. Then the gentle tick of the rule counter.
Julian leaned back. The problem wasn't malice. It wasn't a hacker. It was a ghost in the machine: a mismatch between the intent of a config (written for a forgiving world) and the reality of a program (now pedantic, unforgiving). Current
pfctl -sr pfctl: DIOCGETRULES: Device not configured Not configured? That meant PF wasn’t even running. He checked the logs.