Podman's networking stack (netavark/aardvark-dns) creates bridge interfaces for container isolation and enables pfil_member globally so pf rules apply to container traffic. It does this every time it sets up networking, which is why your manual sysctl reset gets overwritten.
A couple of approaches depending on your FreeBSD version:
If you are on FreeBSD 14+, you can use per-bridge pfil controls instead of the global sysctl. After Podman creates its bridge, the global pfil_member will be 1, but you can disable filtering on your specific jail/VM bridges individually:
Code:
ifconfig bridge0 -pfil_member
Add that to your jail startup script or /etc/rc.local. This way Podman's bridges keep their filtering while your bridges remain unfiltered.
On older FreeBSD where pfil is strictly global, the quickest workaround is a devd rule that resets the sysctl whenever a Podman bridge is created, or a post-start hook in your jail config that runs
Code:
sysctl net.link.bridge.pfil_member=0
and restarts networking.
The cleaner long-term fix would be for Podman on FreeBSD to only set pfil on its own bridge interfaces rather than flipping the global sysctl. That is arguably a bug worth reporting to the FreeBSD Podman port maintainers.
