Nervously, Renny “The Cart” Cartesius stood in an ill-fitting uniform before the throng of federal agents, police, and bystanders. To his chagrin, he noticed that “Blazin'” Pascal was in the crowd, and was staring intently with a look of puzzled half-recognition — and then Pascal’s face lit up as he saw through the imperfect disguise.

Knowing that his cover was about to be blown, The Cart took a calculated risk. Hissing them quietly under his breath, he spoke the immortal words: “incognito ergo schtumm!”

We had a static IP address change on a network that had been in operation for about six years. Since we have gradually been migrating services off to third-party hosting, we no longer need a block of local static IP addresses. To save some ca$h, we are down to one static IP — but that necessitated getting a new IP.

At midnight, the change occurred.

I went into the pfSense admin, got rid of all my 1-to-1 NAT mappings, virtual IPs, and all the firewall rules that protected the no-longer-extant servers. And I couldn’t see the outside world.

I couldn’t even ping the gateway.

Plugging a Mac into the same cable, however, and setting the network parameters, and I had immediate glorious interweb access everywhere.

It was perplexing. The pfSense firewall was configured exactly the same as the Mac. Why u no work firewall?

After a bunch of nonsense, I found the problem. I’d set the WAN interface to our new IP address, and specified it as a single IPv4. I thought I was setting the netmask correctly for a single IP:

IPv4 WAN Address: xxx.xxx.xxx.xxx/32

It turns out, I needed to reduce that netmask. That /32 means *all* of the address is the network submask.

For a single IP address, I used /24 (leaving the entire last byte as my address), although /31 should probably work and would lock it to the specific address.
Edit: The key is the netmask has to leave the gateway in the same subnet as your IP. Doh! You can see I don’t do this kind of stuff enough to know what I[‘m talking about.