{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/choose-pfsense-hybrid-nat-when-only-a-few-source-translations-need-exceptions/", "item": { "id": "https://update.dsesecurity.com/updates/choose-pfsense-hybrid-nat-when-only-a-few-source-translations-need-exceptions/", "slug": "choose-pfsense-hybrid-nat-when-only-a-few-source-translations-need-exceptions", "url": "https://update.dsesecurity.com/updates/choose-pfsense-hybrid-nat-when-only-a-few-source-translations-need-exceptions/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/choose-pfsense-hybrid-nat-when-only-a-few-source-translations-need-exceptions.md", "json": "https://update.dsesecurity.com/api/v1/posts/choose-pfsense-hybrid-nat-when-only-a-few-source-translations-need-exceptions/" }, "title": "Choose pfSense Hybrid NAT when only a few source translations need exceptions", "summary": "Manual rules do not take effect under every outbound NAT mode.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:15:59+00:00", "modified_at": "2026-10-20T18:34:34+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 237, "potentially_affected": "This concerns pfSense outbound source translation.", "dse_recommendation": "DSE recommends starting from the smallest required exception.", "primary_source": { "name": "Netgate — Outbound NAT", "url": "https://docs.netgate.com/pfsense/en/latest/nat/outbound.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Manual rules do not take effect under every outbound NAT mode.

\n

Source facts

\n

Netgate lists Automatic, Hybrid, Manual, and Disabled outbound NAT modes. Hybrid combines administrator-defined rules with automatic rules for unmatched traffic. Manual honors only manually entered rules, so new internal networks and WANs require explicit maintenance. Rules displayed in the list are not honored unless the selected mode is Hybrid or Manual.

\n

Source: Netgate — Outbound NAT.

\n

Applicability

\n

This concerns pfSense outbound source translation.

\n

DSE recommendation

\n

DSE recommends starting from the smallest required exception. If one application needs a particular source address or source-port behavior, assess Hybrid before taking responsibility for the entire translation inventory. Record which internal and VPN subnets must remain translated, and check 1:1 mappings that take precedence. When Manual mode is necessary, add NAT review to the onboarding checklist for every new routed subnet and WAN circuit. Require an explicit answer about who will maintain ordinary translations after the mode change. Include a newly proposed subnet in the review even if it has not been deployed, and make its NAT onboarding step part of the same network provisioning procedure.

\n

Verification

\n

Use approved test clients from each relevant source network, not just the administrator’s workstation. Compare the observed external address with the intended rule and interface. Confirm that unmatched ordinary traffic still works as designed, and that the selected mode actually activates the manual exception being evaluated.

\n

Official reference

\n

Netgate — Outbound NAT. Reviewed October 20, 2026.

", "content_text": "Manual rules do not take effect under every outbound NAT mode.\nSource facts\nNetgate lists Automatic, Hybrid, Manual, and Disabled outbound NAT modes. Hybrid combines administrator-defined rules with automatic rules for unmatched traffic. Manual honors only manually entered rules, so new internal networks and WANs require explicit maintenance. Rules displayed in the list are not honored unless the selected mode is Hybrid or Manual.\nSource: Netgate — Outbound NAT.\nApplicability\nThis concerns pfSense outbound source translation.\nDSE recommendation\nDSE recommends starting from the smallest required exception. If one application needs a particular source address or source-port behavior, assess Hybrid before taking responsibility for the entire translation inventory. Record which internal and VPN subnets must remain translated, and check 1:1 mappings that take precedence. When Manual mode is necessary, add NAT review to the onboarding checklist for every new routed subnet and WAN circuit. Require an explicit answer about who will maintain ordinary translations after the mode change. Include a newly proposed subnet in the review even if it has not been deployed, and make its NAT onboarding step part of the same network provisioning procedure.\nVerification\nUse approved test clients from each relevant source network, not just the administrator’s workstation. Compare the observed external address with the intended rule and interface. Confirm that unmatched ordinary traffic still works as designed, and that the selected mode actually activates the manual exception being evaluated.\nOfficial reference\nNetgate — Outbound NAT. Reviewed October 20, 2026.", "content_markdown": "Manual rules do not take effect under every outbound NAT mode.\n\n## Source facts\n\nNetgate lists Automatic, Hybrid, Manual, and Disabled outbound NAT modes. Hybrid combines administrator-defined rules with automatic rules for unmatched traffic. Manual honors only manually entered rules, so new internal networks and WANs require explicit maintenance. Rules displayed in the list are not honored unless the selected mode is Hybrid or Manual.\n\nSource: [Netgate — Outbound NAT](https://docs.netgate.com/pfsense/en/latest/nat/outbound.html).\n\n## Applicability\n\nThis concerns pfSense outbound source translation.\n\n## DSE recommendation\n\nDSE recommends starting from the smallest required exception. If one application needs a particular source address or source-port behavior, assess Hybrid before taking responsibility for the entire translation inventory. Record which internal and VPN subnets must remain translated, and check 1:1 mappings that take precedence. When Manual mode is necessary, add NAT review to the onboarding checklist for every new routed subnet and WAN circuit. Require an explicit answer about who will maintain ordinary translations after the mode change. Include a newly proposed subnet in the review even if it has not been deployed, and make its NAT onboarding step part of the same network provisioning procedure.\n\n## Verification\n\nUse approved test clients from each relevant source network, not just the administrator’s workstation. Compare the observed external address with the intended rule and interface. Confirm that unmatched ordinary traffic still works as designed, and that the selected mode actually activates the manual exception being evaluated.\n\n## Official reference\n\n[Netgate — Outbound NAT](https://docs.netgate.com/pfsense/en/latest/nat/outbound.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/choose-pfsense-hybrid-nat-when-only-a-few-source-translations-need-exceptions/", "url": "https://update.dsesecurity.com/updates/choose-pfsense-hybrid-nat-when-only-a-few-source-translations-need-exceptions/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/choose-pfsense-hybrid-nat-when-only-a-few-source-translations-need-exceptions/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Choose pfSense Hybrid NAT when only a few source translations need exceptions", "item": "https://update.dsesecurity.com/updates/choose-pfsense-hybrid-nat-when-only-a-few-source-translations-need-exceptions/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/choose-pfsense-hybrid-nat-when-only-a-few-source-translations-need-exceptions/#article", "identifier": "https://update.dsesecurity.com/updates/choose-pfsense-hybrid-nat-when-only-a-few-source-translations-need-exceptions/", "url": "https://update.dsesecurity.com/updates/choose-pfsense-hybrid-nat-when-only-a-few-source-translations-need-exceptions/", "headline": "Choose pfSense Hybrid NAT when only a few source translations need exceptions", "description": "Manual rules do not take effect under every outbound NAT mode.", "abstract": "Manual rules do not take effect under every outbound NAT mode.", "articleBody": "Manual rules do not take effect under every outbound NAT mode.\nSource facts\nNetgate lists Automatic, Hybrid, Manual, and Disabled outbound NAT modes. Hybrid combines administrator-defined rules with automatic rules for unmatched traffic. Manual honors only manually entered rules, so new internal networks and WANs require explicit maintenance. Rules displayed in the list are not honored unless the selected mode is Hybrid or Manual.\nSource: Netgate — Outbound NAT.\nApplicability\nThis concerns pfSense outbound source translation.\nDSE recommendation\nDSE recommends starting from the smallest required exception. If one application needs a particular source address or source-port behavior, assess Hybrid before taking responsibility for the entire translation inventory. Record which internal and VPN subnets must remain translated, and check 1:1 mappings that take precedence. When Manual mode is necessary, add NAT review to the onboarding checklist for every new routed subnet and WAN circuit. Require an explicit answer about who will maintain ordinary translations after the mode change. Include a newly proposed subnet in the review even if it has not been deployed, and make its NAT onboarding step part of the same network provisioning procedure.\nVerification\nUse approved test clients from each relevant source network, not just the administrator’s workstation. Compare the observed external address with the intended rule and interface. Confirm that unmatched ordinary traffic still works as designed, and that the selected mode actually activates the manual exception being evaluated.\nOfficial reference\nNetgate — Outbound NAT. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:15:59+00:00", "dateModified": "2026-10-20T18:34:34+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/choose-pfsense-hybrid-nat-when-only-a-few-source-translations-need-exceptions/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/choose-pfsense-hybrid-nat-when-only-a-few-source-translations-need-exceptions/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose pfSense Hybrid NAT when only a few source translations need exceptions" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 237, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — Outbound NAT", "url": "https://docs.netgate.com/pfsense/en/latest/nat/outbound.html" } } ] } }