Yes, you are correct. The problem is caused by the new default rules that aggressively use keep-state. When Firefox installs extensions, it opens a large number of simultaneous connections, many of which use QUIC over UDP/443. These create a flood of dynamic states in IPFW. Once the state table fills up, older entries such as your OpenVPN session get evicted. With no matching state, VPN packets are blocked by the later deny rules, and OpenVPN does a soft reset.
The simplest way to fix this is to either increase the size of the dynamic state table, or to pin your VPN traffic with an explicit “allow” rule before the generic keep-state rules. Another option is to disable QUIC so Firefox doesn’t generate so many transient UDP states. Finally, cleaning up duplicate 65500 deny rules and making sure you end with a single, clear default-deny will make troubleshooting easier.
In short, Firefox’s QUIC traffic is exhausting IPFW’s dynamic state table under the new rules, and that’s what is disrupting your VPN. Enlarging the table or isolating VPN traffic with its own rules will stabilize the setup.
To get a permanent fix, submit a bug report: ghostbsd/issuesissues
