"Should changing firewall settings to
block all interrupt ongoing ssh session"
The answer is, maybe. It depends on the precise rules, where the
block all appears, and whether existing SSH connections are managed under
keep state (or
set optimization is also relevant; a firewall set to aggressively prune state could drop a session at the same time one is fiddling around with firewall rule changes. There are other relevant settings that may influence whether state is maintained, e.g.
set state-policy might be set to
if-bound, and the SSH packets for some routing reason start showing up on another interface.
pf the last matching rule takes effect, unless
quick is added to a rule. This is opposite of other firewall rules systems, notably iptables on Linux. Thus the exact ordering of rules is important, as is whether
quick is used.
If state is enabled, the existing connections should be preserved through rule changes (unless
set optimization kills them by timeout).
block all will not apply as the last matching rule wins; also, state is maintained for existing SSH connections:
pass out on $ext_if proto tcp all modulate state
pass in on $ext_if proto tcp from any to any port ssh modulate state
The is next ruleset is a secure firewall, in that everything is quickly blocked, though existing SSH connections should still be maintained until the session times out:
block quick all
pass out proto tcp all modulate state
pass in proto tcp from any to any port ssh modulate state
Another way to write the above would be to put
block all as the final rule (unless there are other
quick rules), as by default the last matching rule wins.
(There is also a complication of how new states are matched; you can be less restrictive with
flags any so that state is created for any portion of a TCP connection, not just the default of only new connections via the default
flags S/SA. And other such complications from e.g. asymmetric routing.)
It is also usually a very good idea to have some sort of rollback or recovery option when making firewall rule changes, so that you do not lock yourself out of the system:
# pfctl -f pf.conf; sleep 30; cp pf.conf.bak pf.conf; pfctl -f pf.conf
The rules change (to set
block return quick) did not kill my existing session, so I hit
control+c after mashing a few keys to see if they would be echo'd by the terminal.