Yeah, option 1 is what I do for my own remote machine. 0 * * * * /sbin/pfctl -f /etc/pf.conf.knowngood If needed, copy then edit the known good file, load r

Yeah, option 1 is what I do for my own remote machine. 0 * * * * /sbin/pfctl -f /etc/pf.conf.knowngood If needed, copy then edit the known good file, load rules temporarily, make sure everything works. Make sure the tests have enough time to run (that is: don't reload every minute, but every <long enough duration here>). If all is OK, then backup the old known good file, move the new one in place.