FreeBSD has always had a robust firewall which comes in two flavors: Default deny and Default accept. The second one is common amongst all Unix style firewalls, Linux and otherwise.
A default deny is another animal entirely. When set, nothing goes in or out. For a local server where everything is set on a local console, it works very well. No pings and no connections of any and every kind. On a remote host, hosted by a company remotely, it is difficult to set up, so not recommended.
For the last year we apparently had been happy with only occasional outages, but once they began to affect the server, it was time to change the basic strategy.
In other words, the original strategy was wrong and left Rantburg open to the kinds of problem which had been from the start.
So far, the results are promising.