Should changing firewall settings to block all interrupt ongoing ssh session

Question

Suppose I am logged into a server via ssh. While in the session, I change the firewall config to block all traffic.

When I tried this previously with FreeBSD and pf, the current connection was broken. When I try it now, the current connection remains active but ping (and new connections) doesn't work. I am not sure if there is something else which I am missing.

What is the expected behavior - should this break my current session?

Answer 1

"Should changing firewall settings to block all interrupt ongoing ssh session"

The answer is, maybe. It depends on the precise rules, where the block all appears, and whether existing SSH connections are managed under keep state (or modulate state). set optimization is also relevant; a firewall set to aggressively prune state could drop a session at the same time one is fiddling around with firewall rule changes. There are other relevant settings that may influence whether state is maintained, e.g. set state-policy might be set to if-bound, and the SSH packets for some routing reason start showing up on another interface.

In pf the last matching rule takes effect, unless quick is added to a rule. This is opposite of other firewall rules systems, notably iptables on Linux. Thus the exact ordering of rules is important, as is whether quick is used.

If state is enabled, the existing connections should be preserved through rule changes (unless set optimization kills them by timeout).

An example: block all will not apply as the last matching rule wins; also, state is maintained for existing SSH connections:

block all
pass out on $ext_if proto tcp all modulate state
pass in on  $ext_if proto tcp from any to any port ssh modulate state

The is next ruleset is a secure firewall, in that everything is quickly blocked, though existing SSH connections should still be maintained until the session times out:

block quick all
pass out proto tcp all modulate state
pass in proto tcp from any to any port ssh modulate state

Another way to write the above would be to put block all as the final rule (unless there are other quick rules), as by default the last matching rule wins.

(There is also a complication of how new states are matched; you can be less restrictive with flags any so that state is created for any portion of a TCP connection, not just the default of only new connections via the default flags S/SA. And other such complications from e.g. asymmetric routing.)

It is also usually a very good idea to have some sort of rollback or recovery option when making firewall rule changes, so that you do not lock yourself out of the system:

# pfctl -f pf.conf; sleep 30; cp pf.conf.bak pf.conf; pfctl -f pf.conf
jfkd^C

The rules change (to set block return quick) did not kill my existing session, so I hit control+c after mashing a few keys to see if they would be echo'd by the terminal.