Troubleshooting pfSense Firewall Rules: Fixing High Latency, Packet Loss, and 502 Bad Gateway Errors

Understanding the Error

When managing a pfSense appliance, firewall rules dictate the flow of traffic across interfaces. However, misconfigured rules, state table exhaustion, or hardware-level incompatibilities can manifest as severe network anomalies. Users typically experience these as high latency, consistent packet loss, or upstream application failures like 502 Bad Gateway errors when a reverse proxy (like HAProxy or Nginx) fails to reach backend servers through the firewall.

The firewall is a stateful packet inspection (SPI) device. It tracks the state of network connections. If a packet arrives that does not match an existing state or a permissive firewall rule, it is dropped. When dealing with complex routing (like Multi-WAN or policy-based routing), packets might leave one interface and return on another, leading to asymmetric routing. pfSense will drop the returning packets because they don't match the state table for the interface they arrived on, resulting in instant packet loss and high latency as TCP retransmissions stack up.

Step 1: Diagnose

Before modifying rules, you must identify where the drop is occurring. The pfSense firewall logs (Status > System Logs > Firewall) are your first stop. Look for the red 'X' indicating blocked traffic. If you see legitimate traffic being blocked by the Default deny rule IPv4 (1000000103), it confirms a rule or state issue.

Next, investigate state table issues and packet loss from the pfSense shell or Diagnostics > Command Prompt. You want to check if the state table is full, or if specific interfaces are dropping packets at the hardware/driver level.

Run a continuous ping from a client behind the firewall to an external IP (e.g., 8.8.8.8), and simultaneously run a packet capture (Diagnostics > Packet Capture) on the WAN interface filtering by the client's IP. If you see Echo Requests leaving but no Echo Replies returning, the ISP might be dropping it, or NAT is failing. If Replies return but don't reach the client, the firewall is dropping them on the way back.

For 502 Bad Gateway errors, this often indicates that while the connection to the proxy succeeds, the proxy's connection to the backend is failing. If the proxy and backend are separated by pfSense, check if pfSense is aggressively timing out idle TCP connections, or if hardware checksum offloading is corrupting packets between internal interfaces.

Step 2: Fix

Fix A: Disable Hardware Checksum Offloading

This is the most common culprit for unexplained packet loss and 502 errors, especially with Realtek NICs or virtualized pfSense instances (Proxmox, ESXi).

1. Navigate to System > Advanced > Networking.
2. Check the box for Disable hardware checksum offload.
3. Check the box for Disable hardware TCP segmentation offload.
4. Check the box for Disable hardware large receive offload.
5. Click Save and Reboot the pfSense router. (A reboot is mandatory for these changes to take effect).

Fix B: Resolving Asymmetric Routing

If you have multiple internal routers or complicated VLANs, ensure pfSense is aware of the routing topology. If you cannot fix the physical topology to ensure symmetric routing, you must instruct pfSense to bypass state checking for specific traffic.

1. Go to Firewall > Rules > Floating.
2. Add a new rule.
3. Action: Pass.
4. Quick: Check (Apply the action immediately on match).
5. Interface: Select the interfaces involved in the asymmetric routing.
6. Protocol: TCP/UDP.
7. Source/Destination: Define the affected subnets.
8. Advanced Options: Under State type, select Sloppy State or None. (Sloppy state is generally safer as it still tracks some state but is less strict about sequence numbers).
9. Save and Apply Changes.

Fix C: Addressing High Latency under Load (Bufferbloat)

If latency spikes only occur during heavy downloads/uploads, firewall rules aren't blocking traffic, but the queues are unmanaged. Implement FQ_CODEL limiters.

1. Go to Firewall > Traffic Shaper > Limiters.
2. Create a new Limiter for Download, set bandwidth slightly below your actual max download speed. Set Queue Management Algorithm to CoDel and Scheduler to FQ_CODEL.
3. Create a child queue under this limiter.
4. Repeat for Upload.
5. Go to Firewall > Rules > LAN (or the interface where traffic originates).
6. Edit your default pass rule (or create a specific one).
7. Under Advanced Options > In/Out pipe, select your Upload queue for the 'In' pipe and Download queue for the 'Out' pipe.
8. Save and Apply Changes. This will prioritize interactive traffic and drastically reduce latency spikes.

Fix D: Rule Order and Floating Rules

pfSense evaluates rules from top to bottom on a per-interface basis, stopping at the first match (unless it's a floating rule without 'Quick' selected). Ensure that overly broad block rules are not placed above your specific pass rules. Also, check Firewall > Rules > Floating. Floating rules apply before interface rules. A block floating rule might be dropping traffic before it even reaches your carefully crafted LAN rules.