{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/choose-whether-pfsense-bridge-members-or-the-bridge-interface-own-filtering/", "item": { "id": "https://update.dsesecurity.com/updates/choose-whether-pfsense-bridge-members-or-the-bridge-interface-own-filtering/", "slug": "choose-whether-pfsense-bridge-members-or-the-bridge-interface-own-filtering", "url": "https://update.dsesecurity.com/updates/choose-whether-pfsense-bridge-members-or-the-bridge-interface-own-filtering/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/choose-whether-pfsense-bridge-members-or-the-bridge-interface-own-filtering.md", "json": "https://update.dsesecurity.com/api/v1/posts/choose-whether-pfsense-bridge-members-or-the-bridge-interface-own-filtering/" }, "title": "Choose whether pfSense bridge members or the bridge interface own filtering", "summary": "Rules on an unnumbered member cannot rely on that member's address macros.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:01+00:00", "modified_at": "2026-10-20T18:34:34+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 249, "potentially_affected": "This concerns pfSense bridged Layer 3 filtering.", "dse_recommendation": "DSE recommends selecting one clearly documented policy location before building the rule set.", "primary_source": { "name": "Netgate — Bridging and Firewall Rules", "url": "https://docs.netgate.com/pfsense/en/latest/bridges/firewall.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Rules on an unnumbered member cannot rely on that member’s address macros.

\n

Source facts

\n

Netgate documents separate pfil_member and pfil_bridge tunables controlling filtering on bridge members and the bridge itself; at least one must be enabled. Only one bridge interface or member holds the IP address. Address and network macros for an unnumbered member are undefined, so rules must use explicit subnets or the macros belonging to the numbered interface.

\n

Source: Netgate — Bridging and Firewall Rules.

\n

Applicability

\n

This concerns pfSense bridged Layer 3 filtering.

\n

DSE recommendation

\n

DSE recommends selecting one clearly documented policy location before building the rule set. Record the tunable values and which interface actually owns the subnet. Replace ambiguous unnumbered-member macros with deliberate address objects. During a migration, review both the old and new filter locations so a rule is not accidentally stranded on a tab that no longer controls traffic. Keep management access within the same policy review. Document the policy owner beside the numbered interface in the bridge diagram. Include a denied management attempt in the rehearsal, and compare both filtering locations after any migration. Require the final rule inventory to identify which tabs remain operationally relevant.

\n

Verification

\n

On an approved test bridge, generate new allowed and denied flows from each member. Confirm which rule counters change and whether source and destination macros expand as expected. Record the active filtering location with the final configuration rather than relying on the GUI tab names alone.

\n

Official reference

\n

Netgate — Bridging and Firewall Rules. Reviewed October 20, 2026.

", "content_text": "Rules on an unnumbered member cannot rely on that member’s address macros.\nSource facts\nNetgate documents separate pfil_member and pfil_bridge tunables controlling filtering on bridge members and the bridge itself; at least one must be enabled. Only one bridge interface or member holds the IP address. Address and network macros for an unnumbered member are undefined, so rules must use explicit subnets or the macros belonging to the numbered interface.\nSource: Netgate — Bridging and Firewall Rules.\nApplicability\nThis concerns pfSense bridged Layer 3 filtering.\nDSE recommendation\nDSE recommends selecting one clearly documented policy location before building the rule set. Record the tunable values and which interface actually owns the subnet. Replace ambiguous unnumbered-member macros with deliberate address objects. During a migration, review both the old and new filter locations so a rule is not accidentally stranded on a tab that no longer controls traffic. Keep management access within the same policy review. Document the policy owner beside the numbered interface in the bridge diagram. Include a denied management attempt in the rehearsal, and compare both filtering locations after any migration. Require the final rule inventory to identify which tabs remain operationally relevant.\nVerification\nOn an approved test bridge, generate new allowed and denied flows from each member. Confirm which rule counters change and whether source and destination macros expand as expected. Record the active filtering location with the final configuration rather than relying on the GUI tab names alone.\nOfficial reference\nNetgate — Bridging and Firewall Rules. Reviewed October 20, 2026.", "content_markdown": "Rules on an unnumbered member cannot rely on that member’s address macros.\n\n## Source facts\n\nNetgate documents separate pfil_member and pfil_bridge tunables controlling filtering on bridge members and the bridge itself; at least one must be enabled. Only one bridge interface or member holds the IP address. Address and network macros for an unnumbered member are undefined, so rules must use explicit subnets or the macros belonging to the numbered interface.\n\nSource: [Netgate — Bridging and Firewall Rules](https://docs.netgate.com/pfsense/en/latest/bridges/firewall.html).\n\n## Applicability\n\nThis concerns pfSense bridged Layer 3 filtering.\n\n## DSE recommendation\n\nDSE recommends selecting one clearly documented policy location before building the rule set. Record the tunable values and which interface actually owns the subnet. Replace ambiguous unnumbered-member macros with deliberate address objects. During a migration, review both the old and new filter locations so a rule is not accidentally stranded on a tab that no longer controls traffic. Keep management access within the same policy review. Document the policy owner beside the numbered interface in the bridge diagram. Include a denied management attempt in the rehearsal, and compare both filtering locations after any migration. Require the final rule inventory to identify which tabs remain operationally relevant.\n\n## Verification\n\nOn an approved test bridge, generate new allowed and denied flows from each member. Confirm which rule counters change and whether source and destination macros expand as expected. Record the active filtering location with the final configuration rather than relying on the GUI tab names alone.\n\n## Official reference\n\n[Netgate — Bridging and Firewall Rules](https://docs.netgate.com/pfsense/en/latest/bridges/firewall.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/choose-whether-pfsense-bridge-members-or-the-bridge-interface-own-filtering/", "url": "https://update.dsesecurity.com/updates/choose-whether-pfsense-bridge-members-or-the-bridge-interface-own-filtering/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/choose-whether-pfsense-bridge-members-or-the-bridge-interface-own-filtering/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Choose whether pfSense bridge members or the bridge interface own filtering", "item": "https://update.dsesecurity.com/updates/choose-whether-pfsense-bridge-members-or-the-bridge-interface-own-filtering/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/choose-whether-pfsense-bridge-members-or-the-bridge-interface-own-filtering/#article", "identifier": "https://update.dsesecurity.com/updates/choose-whether-pfsense-bridge-members-or-the-bridge-interface-own-filtering/", "url": "https://update.dsesecurity.com/updates/choose-whether-pfsense-bridge-members-or-the-bridge-interface-own-filtering/", "headline": "Choose whether pfSense bridge members or the bridge interface own filtering", "description": "Rules on an unnumbered member cannot rely on that member's address macros.", "abstract": "Rules on an unnumbered member cannot rely on that member's address macros.", "articleBody": "Rules on an unnumbered member cannot rely on that member’s address macros.\nSource facts\nNetgate documents separate pfil_member and pfil_bridge tunables controlling filtering on bridge members and the bridge itself; at least one must be enabled. Only one bridge interface or member holds the IP address. Address and network macros for an unnumbered member are undefined, so rules must use explicit subnets or the macros belonging to the numbered interface.\nSource: Netgate — Bridging and Firewall Rules.\nApplicability\nThis concerns pfSense bridged Layer 3 filtering.\nDSE recommendation\nDSE recommends selecting one clearly documented policy location before building the rule set. Record the tunable values and which interface actually owns the subnet. Replace ambiguous unnumbered-member macros with deliberate address objects. During a migration, review both the old and new filter locations so a rule is not accidentally stranded on a tab that no longer controls traffic. Keep management access within the same policy review. Document the policy owner beside the numbered interface in the bridge diagram. Include a denied management attempt in the rehearsal, and compare both filtering locations after any migration. Require the final rule inventory to identify which tabs remain operationally relevant.\nVerification\nOn an approved test bridge, generate new allowed and denied flows from each member. Confirm which rule counters change and whether source and destination macros expand as expected. Record the active filtering location with the final configuration rather than relying on the GUI tab names alone.\nOfficial reference\nNetgate — Bridging and Firewall Rules. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:01+00:00", "dateModified": "2026-10-20T18:34:34+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/choose-whether-pfsense-bridge-members-or-the-bridge-interface-own-filtering/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/choose-whether-pfsense-bridge-members-or-the-bridge-interface-own-filtering/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose whether pfSense bridge members or the bridge interface own filtering" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 249, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — Bridging and Firewall Rules", "url": "https://docs.netgate.com/pfsense/en/latest/bridges/firewall.html" } } ] } }