pfSense

Able to reproduce.

It looks like pfSense_kill_status() and pfSense_kill_src states() are successfully kill TCP and ICMP sessions, but not UDP.

This may also be an issue prior to pfSense 22.05/2.7 (ipfw captive portal).

The root issue here is actually #11556. When pfSense_kill_states() is called, the state on WAN using NAT will remain due to the referenced issue, hence allowing reply traffic. That reply traffic will then reach the host behind the Captive Portal due the default rule which allows all traffic from the firewall itself. See the following states:

Before calling pfSense_kill_states()

all udp 198.51.100.7:1196 <- 10.0.1.100:62722       MULTIPLE:MULTIPLE
   age 00:01:05, expires in 00:01:00, 254:238 pkts, 42969:117085 bytes, rule 539
   id: db5e9a6300000000 creatorid: 4da82510 gateway: 0.0.0.0
   origif: vmx0
all udp 192.0.2.5:39681 (10.0.1.100:62722) -> 198.51.100.7:1196       MULTIPLE:MULTIPLE
   age 00:01:05, expires in 00:01:00, 254:238 pkts, 42969:117085 bytes, rule 145
   id: dc5e9a6300000000 creatorid: 4da82510 gateway: 177.231.47.1
   origif: vmx0.99

After calling pfSense_kill_states() and before reply from remote:

all udp 192.0.2.5:39681 (10.0.1.100:62722) -> 198.51.100.7:1196       MULTIPLE:MULTIPLE
   age 00:01:21, expires in 00:00:49, 264:248 pkts, 44119:118305 bytes, rule 145
   id: dc5e9a6300000000 creatorid: 4da82510 gateway: 177.231.47.1
   origif: vmx0.99

After calling pfSense_kill_states() and after reply from remote:

all udp 192.0.2.5:39681 (10.0.1.100:62722) -> 198.51.100.7:1196       MULTIPLE:MULTIPLE
   age 00:01:29, expires in 00:00:59, 268:253 pkts, 44569:118869 bytes, rule 145
   id: dc5e9a6300000000 creatorid: 4da82510 gateway: 177.231.47.1
   origif: vmx0.99
all udp 198.51.100.7:1196 -> 10.0.1.100:62722       MULTIPLE:MULTIPLE
   age 00:00:08, expires in 00:00:59, 5:4 pkts, 564:450 bytes, rule 143
   id: 65659a6300000000 creatorid: 4da82510 gateway: 0.0.0.0
   origif: vmx0