{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/define-what-pfsense-permits-outside-a-scheduled-rule-window/", "item": { "id": "https://update.dsesecurity.com/updates/define-what-pfsense-permits-outside-a-scheduled-rule-window/", "slug": "define-what-pfsense-permits-outside-a-scheduled-rule-window", "url": "https://update.dsesecurity.com/updates/define-what-pfsense-permits-outside-a-scheduled-rule-window/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/define-what-pfsense-permits-outside-a-scheduled-rule-window.md", "json": "https://update.dsesecurity.com/api/v1/posts/define-what-pfsense-permits-outside-a-scheduled-rule-window/" }, "title": "Define what pfSense permits outside a scheduled rule window", "summary": "An inactive scheduled rule disappears from consideration; its action is not reversed.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:15:54+00:00", "modified_at": "2026-10-20T18:34:34+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 253, "potentially_affected": "This concerns pfSense scheduled firewall rules, rather than application account expiry or an assurance that every previously established session terminates at the boundary.", "dse_recommendation": "DSE recommends writing the desired outcome inside and outside the window before creating the schedule.", "primary_source": { "name": "Netgate — Time Based Rules", "url": "https://docs.netgate.com/pfsense/en/latest/firewall/time-based-rules.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

An inactive scheduled rule disappears from consideration; its action is not reversed.

\n

Source facts

\n

Netgate states that a time-based rule behaves as absent outside its schedule. A scheduled pass therefore needs a separate applicable block if access must stop outside the window. Schedules can contain several ranges, use local time, and cannot express a single range crossing midnight.

\n

Source: Netgate — Time Based Rules.

\n

Applicability

\n

This concerns pfSense scheduled firewall rules, rather than application account expiry or an assurance that every previously established session terminates at the boundary.

\n

DSE recommendation

\n

DSE recommends writing the desired outcome inside and outside the window before creating the schedule. Inspect rules underneath it for broader passes that would still permit access. Split overnight access into ranges that match the actual calendar days. Record the firewall time zone and the operational owner of holidays or temporary exceptions. Keep the schedule name meaningful to the business requirement rather than relying on a time range that may be reused elsewhere. Include an overnight example and a normal business-day example in the acceptance plan. Ask the access owner to approve the outside-window result explicitly, including whether a separate rule should deny the request or allow it under another documented business exception.

\n

Verification

\n

In an approved test, attempt fresh connections immediately before, within, and after the scheduled window. Check the firewall’s displayed clock and matching rule for each attempt. Review existing-session handling separately instead of assuming a successful new-connection test also proves immediate session termination.

\n

Official reference

\n

Netgate — Time Based Rules. Reviewed October 20, 2026.

", "content_text": "An inactive scheduled rule disappears from consideration; its action is not reversed.\nSource facts\nNetgate states that a time-based rule behaves as absent outside its schedule. A scheduled pass therefore needs a separate applicable block if access must stop outside the window. Schedules can contain several ranges, use local time, and cannot express a single range crossing midnight.\nSource: Netgate — Time Based Rules.\nApplicability\nThis concerns pfSense scheduled firewall rules, rather than application account expiry or an assurance that every previously established session terminates at the boundary.\nDSE recommendation\nDSE recommends writing the desired outcome inside and outside the window before creating the schedule. Inspect rules underneath it for broader passes that would still permit access. Split overnight access into ranges that match the actual calendar days. Record the firewall time zone and the operational owner of holidays or temporary exceptions. Keep the schedule name meaningful to the business requirement rather than relying on a time range that may be reused elsewhere. Include an overnight example and a normal business-day example in the acceptance plan. Ask the access owner to approve the outside-window result explicitly, including whether a separate rule should deny the request or allow it under another documented business exception.\nVerification\nIn an approved test, attempt fresh connections immediately before, within, and after the scheduled window. Check the firewall’s displayed clock and matching rule for each attempt. Review existing-session handling separately instead of assuming a successful new-connection test also proves immediate session termination.\nOfficial reference\nNetgate — Time Based Rules. Reviewed October 20, 2026.", "content_markdown": "An inactive scheduled rule disappears from consideration; its action is not reversed.\n\n## Source facts\n\nNetgate states that a time-based rule behaves as absent outside its schedule. A scheduled pass therefore needs a separate applicable block if access must stop outside the window. Schedules can contain several ranges, use local time, and cannot express a single range crossing midnight.\n\nSource: [Netgate — Time Based Rules](https://docs.netgate.com/pfsense/en/latest/firewall/time-based-rules.html).\n\n## Applicability\n\nThis concerns pfSense scheduled firewall rules, rather than application account expiry or an assurance that every previously established session terminates at the boundary.\n\n## DSE recommendation\n\nDSE recommends writing the desired outcome inside and outside the window before creating the schedule. Inspect rules underneath it for broader passes that would still permit access. Split overnight access into ranges that match the actual calendar days. Record the firewall time zone and the operational owner of holidays or temporary exceptions. Keep the schedule name meaningful to the business requirement rather than relying on a time range that may be reused elsewhere. Include an overnight example and a normal business-day example in the acceptance plan. Ask the access owner to approve the outside-window result explicitly, including whether a separate rule should deny the request or allow it under another documented business exception.\n\n## Verification\n\nIn an approved test, attempt fresh connections immediately before, within, and after the scheduled window. Check the firewall’s displayed clock and matching rule for each attempt. Review existing-session handling separately instead of assuming a successful new-connection test also proves immediate session termination.\n\n## Official reference\n\n[Netgate — Time Based Rules](https://docs.netgate.com/pfsense/en/latest/firewall/time-based-rules.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/define-what-pfsense-permits-outside-a-scheduled-rule-window/", "url": "https://update.dsesecurity.com/updates/define-what-pfsense-permits-outside-a-scheduled-rule-window/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/define-what-pfsense-permits-outside-a-scheduled-rule-window/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Define what pfSense permits outside a scheduled rule window", "item": "https://update.dsesecurity.com/updates/define-what-pfsense-permits-outside-a-scheduled-rule-window/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/define-what-pfsense-permits-outside-a-scheduled-rule-window/#article", "identifier": "https://update.dsesecurity.com/updates/define-what-pfsense-permits-outside-a-scheduled-rule-window/", "url": "https://update.dsesecurity.com/updates/define-what-pfsense-permits-outside-a-scheduled-rule-window/", "headline": "Define what pfSense permits outside a scheduled rule window", "description": "An inactive scheduled rule disappears from consideration; its action is not reversed.", "abstract": "An inactive scheduled rule disappears from consideration; its action is not reversed.", "articleBody": "An inactive scheduled rule disappears from consideration; its action is not reversed.\nSource facts\nNetgate states that a time-based rule behaves as absent outside its schedule. A scheduled pass therefore needs a separate applicable block if access must stop outside the window. Schedules can contain several ranges, use local time, and cannot express a single range crossing midnight.\nSource: Netgate — Time Based Rules.\nApplicability\nThis concerns pfSense scheduled firewall rules, rather than application account expiry or an assurance that every previously established session terminates at the boundary.\nDSE recommendation\nDSE recommends writing the desired outcome inside and outside the window before creating the schedule. Inspect rules underneath it for broader passes that would still permit access. Split overnight access into ranges that match the actual calendar days. Record the firewall time zone and the operational owner of holidays or temporary exceptions. Keep the schedule name meaningful to the business requirement rather than relying on a time range that may be reused elsewhere. Include an overnight example and a normal business-day example in the acceptance plan. Ask the access owner to approve the outside-window result explicitly, including whether a separate rule should deny the request or allow it under another documented business exception.\nVerification\nIn an approved test, attempt fresh connections immediately before, within, and after the scheduled window. Check the firewall’s displayed clock and matching rule for each attempt. Review existing-session handling separately instead of assuming a successful new-connection test also proves immediate session termination.\nOfficial reference\nNetgate — Time Based Rules. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:15:54+00:00", "dateModified": "2026-10-20T18:34:34+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/define-what-pfsense-permits-outside-a-scheduled-rule-window/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/define-what-pfsense-permits-outside-a-scheduled-rule-window/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Define what pfSense permits outside a scheduled rule window" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 253, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — Time Based Rules", "url": "https://docs.netgate.com/pfsense/en/latest/firewall/time-based-rules.html" } } ] } }