I finally noticed that packets with destination 127.0.0.1 were being routed out my main external interface. Why? Don't ask me. So I added this rule:
pass in quick on xl2 route-to lo0 from any to 127.0.0.1 keep state
Maybe this has something to do with the fact that I've got two external interfaces (xl0 goes to our old frac. T1, xl1 goes to our new full T1). We use xl0 to service our WAN, with all the large traffic from our main support center going out xl1. Anyone have some forensic analysis as to why I had to add this rule?
netstat -nrf inet can verify that the right interface is being used by the routing tables. But route-to bypasses that, so if you're using it in other pf rules, I would look there first. Perhaps you have something like "pass in on xl2 route-to xl1 from $support to any"?
