{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/check-pfsense-rule-classes-before-trying-to-override-a-group-block/", "item": { "id": "https://update.dsesecurity.com/updates/check-pfsense-rule-classes-before-trying-to-override-a-group-block/", "slug": "check-pfsense-rule-classes-before-trying-to-override-a-group-block", "url": "https://update.dsesecurity.com/updates/check-pfsense-rule-classes-before-trying-to-override-a-group-block/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/check-pfsense-rule-classes-before-trying-to-override-a-group-block.md", "json": "https://update.dsesecurity.com/api/v1/posts/check-pfsense-rule-classes-before-trying-to-override-a-group-block/" }, "title": "Check pfSense rule classes before trying to override a group block", "summary": "A rule placed on an interface cannot override an earlier matching group rule.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:15:52+00:00", "modified_at": "2026-10-20T18:34:34+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 239, "potentially_affected": "This concerns Layer 3 rule processing in pfSense, including the special VPN groups.", "dse_recommendation": "DSE recommends drawing the incoming interface and every group containing it before adding an exception.", "primary_source": { "name": "Netgate — Rule Methodology", "url": "https://docs.netgate.com/pfsense/en/latest/firewall/rule-methodology.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A rule placed on an interface cannot override an earlier matching group rule.

\n

Source facts

\n

Netgate documents floating rules before interface-group rules, followed by interface rules. A matching group block has already acted before an interface-tab rule is reached. Interface and group rules filter inbound traffic; an allowed connection normally creates state that permits its replies.

\n

Source: Netgate — Rule Methodology.

\n

Applicability

\n

This concerns Layer 3 rule processing in pfSense, including the special VPN groups.

\n

DSE recommendation

\n

DSE recommends drawing the incoming interface and every group containing it before adding an exception. Put the exception within the class that currently makes the decision, with the narrowest required source, destination, and protocol. Do not accumulate ineffective allow rules on lower tabs. Include floating rules in the review even when another administrator originally installed them. Record which rule should decide both the approved connection and an adjacent connection that should remain blocked. Have a second administrator trace the exception through the ordered classes before approval. Include the matching group name in the test record, so an apparently successful interface edit cannot be credited when a broader earlier rule actually allowed the connection.

\n

Verification

\n

During an approved change window, use a new connection and inspect its matching rule and state. Compare the intended exception with a denied peer. If existing state masks the change, remove only the authorized test state and repeat; do not clear unrelated sessions.

\n

Official reference

\n

Netgate — Rule Methodology. Reviewed October 20, 2026.

", "content_text": "A rule placed on an interface cannot override an earlier matching group rule.\nSource facts\nNetgate documents floating rules before interface-group rules, followed by interface rules. A matching group block has already acted before an interface-tab rule is reached. Interface and group rules filter inbound traffic; an allowed connection normally creates state that permits its replies.\nSource: Netgate — Rule Methodology.\nApplicability\nThis concerns Layer 3 rule processing in pfSense, including the special VPN groups.\nDSE recommendation\nDSE recommends drawing the incoming interface and every group containing it before adding an exception. Put the exception within the class that currently makes the decision, with the narrowest required source, destination, and protocol. Do not accumulate ineffective allow rules on lower tabs. Include floating rules in the review even when another administrator originally installed them. Record which rule should decide both the approved connection and an adjacent connection that should remain blocked. Have a second administrator trace the exception through the ordered classes before approval. Include the matching group name in the test record, so an apparently successful interface edit cannot be credited when a broader earlier rule actually allowed the connection.\nVerification\nDuring an approved change window, use a new connection and inspect its matching rule and state. Compare the intended exception with a denied peer. If existing state masks the change, remove only the authorized test state and repeat; do not clear unrelated sessions.\nOfficial reference\nNetgate — Rule Methodology. Reviewed October 20, 2026.", "content_markdown": "A rule placed on an interface cannot override an earlier matching group rule.\n\n## Source facts\n\nNetgate documents floating rules before interface-group rules, followed by interface rules. A matching group block has already acted before an interface-tab rule is reached. Interface and group rules filter inbound traffic; an allowed connection normally creates state that permits its replies.\n\nSource: [Netgate — Rule Methodology](https://docs.netgate.com/pfsense/en/latest/firewall/rule-methodology.html).\n\n## Applicability\n\nThis concerns Layer 3 rule processing in pfSense, including the special VPN groups.\n\n## DSE recommendation\n\nDSE recommends drawing the incoming interface and every group containing it before adding an exception. Put the exception within the class that currently makes the decision, with the narrowest required source, destination, and protocol. Do not accumulate ineffective allow rules on lower tabs. Include floating rules in the review even when another administrator originally installed them. Record which rule should decide both the approved connection and an adjacent connection that should remain blocked. Have a second administrator trace the exception through the ordered classes before approval. Include the matching group name in the test record, so an apparently successful interface edit cannot be credited when a broader earlier rule actually allowed the connection.\n\n## Verification\n\nDuring an approved change window, use a new connection and inspect its matching rule and state. Compare the intended exception with a denied peer. If existing state masks the change, remove only the authorized test state and repeat; do not clear unrelated sessions.\n\n## Official reference\n\n[Netgate — Rule Methodology](https://docs.netgate.com/pfsense/en/latest/firewall/rule-methodology.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/check-pfsense-rule-classes-before-trying-to-override-a-group-block/", "url": "https://update.dsesecurity.com/updates/check-pfsense-rule-classes-before-trying-to-override-a-group-block/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/check-pfsense-rule-classes-before-trying-to-override-a-group-block/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Check pfSense rule classes before trying to override a group block", "item": "https://update.dsesecurity.com/updates/check-pfsense-rule-classes-before-trying-to-override-a-group-block/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/check-pfsense-rule-classes-before-trying-to-override-a-group-block/#article", "identifier": "https://update.dsesecurity.com/updates/check-pfsense-rule-classes-before-trying-to-override-a-group-block/", "url": "https://update.dsesecurity.com/updates/check-pfsense-rule-classes-before-trying-to-override-a-group-block/", "headline": "Check pfSense rule classes before trying to override a group block", "description": "A rule placed on an interface cannot override an earlier matching group rule.", "abstract": "A rule placed on an interface cannot override an earlier matching group rule.", "articleBody": "A rule placed on an interface cannot override an earlier matching group rule.\nSource facts\nNetgate documents floating rules before interface-group rules, followed by interface rules. A matching group block has already acted before an interface-tab rule is reached. Interface and group rules filter inbound traffic; an allowed connection normally creates state that permits its replies.\nSource: Netgate — Rule Methodology.\nApplicability\nThis concerns Layer 3 rule processing in pfSense, including the special VPN groups.\nDSE recommendation\nDSE recommends drawing the incoming interface and every group containing it before adding an exception. Put the exception within the class that currently makes the decision, with the narrowest required source, destination, and protocol. Do not accumulate ineffective allow rules on lower tabs. Include floating rules in the review even when another administrator originally installed them. Record which rule should decide both the approved connection and an adjacent connection that should remain blocked. Have a second administrator trace the exception through the ordered classes before approval. Include the matching group name in the test record, so an apparently successful interface edit cannot be credited when a broader earlier rule actually allowed the connection.\nVerification\nDuring an approved change window, use a new connection and inspect its matching rule and state. Compare the intended exception with a denied peer. If existing state masks the change, remove only the authorized test state and repeat; do not clear unrelated sessions.\nOfficial reference\nNetgate — Rule Methodology. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:15:52+00:00", "dateModified": "2026-10-20T18:34:34+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/check-pfsense-rule-classes-before-trying-to-override-a-group-block/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/check-pfsense-rule-classes-before-trying-to-override-a-group-block/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check pfSense rule classes before trying to override a group block" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 239, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — Rule Methodology", "url": "https://docs.netgate.com/pfsense/en/latest/firewall/rule-methodology.html" } } ] } }