I have just noticed that with FreeBSD Jails updated to 15.1-RELEASE, they can't load new firewall rules via "pfctl -f /etc/pf.conf" anymore, if the jail's securelevel is set to 2 or higher. On FreeBSD 15.0 and before this worked.
Is there something I can do to restore this behaviour or do I have to set all my VNET jails to securelevel 1 to allow pfctl to make changes again?
I understand that this is a feature, not a bug, but it still kinda surprised me.
---
Edit
According to the security(7) man page, kern.securelevel should only block changes to pf and ipfw rulesets at level 3, but my jails only run at level 2???
subnetspider
npub14l…eav3d
2026-10-10 20:33:55 UTC
Author Public Key
npub14ln3qcf05p0dla6wpwpvyq8z4g85pg5jgjezjljrea8ujyk73s7sleav3dPublished at
2026-10-10 20:33:55 UTCEvent JSON
{
"id": "d790587a42e7e22ad45a686c3eea8af43f17ec4b86711e0bea8c9dcfa03d7d53",
"pubkey": "afe710612fa05edff74e0b82c200e2aa0f40a29244b2297e43cf4fc912de8c3d",
"created_at": 1791664435,
"kind": 1,
"tags": [
[
"proxy",
"https://mastodon.bsd.cafe/@subnetspider/117418520470453180",
"web"
],
[
"proxy",
"https://mastodon.bsd.cafe/users/subnetspider/statuses/117418520470453180",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://mastodon.bsd.cafe/users/subnetspider/statuses/117418520470453180",
"pink.momostr"
],
[
"-"
]
],
"content": "I have just noticed that with FreeBSD Jails updated to 15.1-RELEASE, they can't load new firewall rules via \"pfctl -f /etc/pf.conf\" anymore, if the jail's securelevel is set to 2 or higher. On FreeBSD 15.0 and before this worked.\n\nIs there something I can do to restore this behaviour or do I have to set all my VNET jails to securelevel 1 to allow pfctl to make changes again?\n\nI understand that this is a feature, not a bug, but it still kinda surprised me.\n\n---\n\nEdit\n\nAccording to the security(7) man page, kern.securelevel should only block changes to pf and ipfw rulesets at level 3, but my jails only run at level 2???",
"sig": "2b0b4e0c399df8d2df466ae18f0253541eac572267ab407d10205d821cbd9107bc8e9de2b8b588ee2ca59cabc92ff8614a7f2d58fd60d64e4dd057035b103c8d"
}