The most important thing:
> Additionally, the scrubbing process has fixed the packet, so now any operating system behind the firewall accepts the packet.
Ie if you are running a router based on pf (including pfSene and OPNSense, I suppose) you are probably fine, because you have only ssh and webgui on this host.
If you have a full OS running some services (eg MySQL and like) for which you rely on the firewall to block the external connections (instead of binding to localhost or LAn interface) then you are at risk.
Attacker should know what you are running that service or probe the known running hosts, so the opportunity is low.
ADD: it's not clear for me, but looks like this works for the forwarded (aka routed) packets as well. If yes, the 'known hosts' still apply but exposure is a bit bigger. If you are running pf firewalls with a full IPV6 connectivity - update ASAP.
> Additionally, the scrubbing process has fixed the packet, so now any operating system behind the firewall accepts the packet.
Ie if you are running a router based on pf (including pfSene and OPNSense, I suppose) you are probably fine, because you have only ssh and webgui on this host.
If you have a full OS running some services (eg MySQL and like) for which you rely on the firewall to block the external connections (instead of binding to localhost or LAn interface) then you are at risk.
Attacker should know what you are running that service or probe the known running hosts, so the opportunity is low.
ADD: it's not clear for me, but looks like this works for the forwarded (aka routed) packets as well. If yes, the 'known hosts' still apply but exposure is a bit bigger. If you are running pf firewalls with a full IPV6 connectivity - update ASAP.