Troubleshooting Checklist

Use this sequence before opening a support request.

1. Confirm known-good baseline

• Exact version and architecture recorded
• Issue reproduces consistently
• No untracked recent config changes

2. Interface and route sanity

• WAN/LAN assignment correct
• WAN addressing and gateway valid
• LAN subnet and DHCP behavior valid
• Default route on WAN present

3. Firewall path checks (pf behavior)

• Correct rule on correct interface
• Rule order reflects intended match precedence
• State creation visible for expected traffic
• Logs show pass/block outcomes consistent with policy intent

4. NAT and service checks

• Port forward target IP/port correct
• Matching allow policy exists after translation
• Service on target host is listening on expected port
• External testing performed from outside local LAN path

5. DNS, IP Pool mapping, and time checks

• Resolver returns expected answers
• If using DNS forwarder IP pool mapping:
• Domain mapping is configured in DNS forwarder
• Queries are actually flowing through this firewall's DNS forwarder
• Target IP Pool exists and is referenced by firewall rules
• pf table contents reflect expected resolved addresses
• NTP/time is accurate (critical for VPN/TLS)

6. VPN mode checks (when relevant)

• IPsec: phase alignment, peer identifiers, subnet selectors
• L2TP/IPsec: client pool, PSK, and user auth path
• PPTP (legacy): TCP/1723 and GRE path plus user auth

7. Capture support evidence

• Interface mapping screenshot/text
• Relevant firewall/NAT/VPN pages
• Logs around exact test timestamps
• Repro steps and expected vs actual behavior

Common symptom guide

Symptom	Primary areas to inspect
No Internet from LAN	WAN route, DNS, firewall policy
Port forward fails	NAT mapping + corresponding pass policy
VPN up, no traffic	phase2 subnet scope, firewall policy, routing
DNS-name policy mismatch	DNS forwarder mapping, IP Pool table contents, rule source/destination pool
Web UI unreachable	interface assignment, LAN addressing, management policy