Then the prayer:
echo "table <api_sources> persist 10.88.12.0/24, 10.88.13.0/24 " >> /etc/pf.conf sed -i '87s/from .* /from <api_sources>/' /etc/pf.conf pf configuration incompatible with pf program version
He VPN’d in, his coffee cold before he’d even poured it. The first command was ritual. It saw the curly braces, expanded the list
The old PF (the one running on 7.4) had been lenient. It saw the curly braces, expanded the list in memory, and carried on. The new PF was a stricter grammarian. It saw the same syntax, declared it heresy, and refused to load any rules at all. Zero firewall. No state table. No blocking. No logging. Zero firewall
Julian’s hands flew. He couldn’t rewrite the whole config at 3:30 AM. He had one shot.
gw-04-dfw wasn't just in a backup state. It was a naked machine on the public internet, its interface wide open.