Virtualized pfSense with VirtIO: no traffic until hardware checksum offload is disabled
With vtnet, FreeBSD drops packets whose checksum was never computed. Tick Disable hardware checksum offload and reboot the VM even though the GUI does not ask; until then no traffic flows.