pfctl -sT lists tables; pfctl -t -T show|add|delete|test|flush|replace -f. On pfSense aliases are tables, sshguard is the failed-login lockout, and manual changes vanish on the next rules reload.
LAN → public IP traffic never leaves through the WAN, it dies at the firewall. Split DNS (host override → internal IP) is the clean way; Pure NAT + automatic outbound NAT for reflection when the DNS is not yours.
pkg-static does not depend on libssl and keeps working. certctl rehash, pkg-static install -fy pkg, pkg-static install -xfy pfSense-repo pfSense-upgrade, then the upgrade through System > Update, never with pkg upgrade.
Cloudflare token with Zone:Read + DNS:Edit on the zone, DNS-Cloudflare method with Token/Account ID/Zone ID, staging first, and a ‘Restart Local Service: haproxy’ action on the certificate so HAProxy reloads the new cert.
Edit the CRL under System > Certificates > Certificate Revocation, set Lifetime 730 and save: it is regenerated with valid dates. On old versions, apply the ‘Fix for CRL expiration lifetime’ patch with System Patches first.
With vtnet, FreeBSD drops packets whose checksum was never computed. Tick Disable hardware checksum offload and reboot the VM even though the GUI does not ask; until then no traffic flows.