{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/give-pfsense-forwarding-dns-a-viable-route-through-each-wan/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/give-pfsense-forwarding-dns-a-viable-route-through-each-wan/",
        "slug": "give-pfsense-forwarding-dns-a-viable-route-through-each-wan",
        "url": "https://update.dsesecurity.com/updates/give-pfsense-forwarding-dns-a-viable-route-through-each-wan/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/give-pfsense-forwarding-dns-a-viable-route-through-each-wan.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/give-pfsense-forwarding-dns-a-viable-route-through-each-wan/"
        },
        "title": "Give pfSense forwarding DNS a viable route through each WAN",
        "summary": "A second Internet circuit is insufficient if all configured resolvers depend on the failed first circuit.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:16:05+00:00",
        "modified_at": "2026-10-20T18:34:34+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 253,
        "potentially_affected": "This concerns pfSense DNS Resolver modes and DNS Forwarder configuration.",
        "dse_recommendation": "DSE recommends recording whether the installation performs recursive resolution or forwards to selected servers before changing Multi-WAN DNS.",
        "primary_source": {
            "name": "Netgate — Interface and DNS Configuration",
            "url": "https://docs.netgate.com/pfsense/en/latest/multiwan/interfaces-and-dns.html",
            "published_on": null,
            "authority": "docs.netgate.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A second Internet circuit is insufficient if all configured resolvers depend on the failed first circuit.</p>\n<h2>Source facts</h2>\n<p>Netgate explains that DNS forwarding uses the firewall routing table. Configured DNS servers can be associated with gateways so queries use a specific WAN, and the source calls for unique server entries rather than repeating one address for several gateways. Default recursive-resolver operation instead requires default-gateway failover for Multi-WAN resilience.</p>\n<p>Source: <a href=\"https://docs.netgate.com/pfsense/en/latest/multiwan/interfaces-and-dns.html\">Netgate — Interface and DNS Configuration</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns pfSense DNS Resolver modes and DNS Forwarder configuration.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends recording whether the installation performs recursive resolution or forwards to selected servers before changing Multi-WAN DNS. For forwarding, map each resolver to an appropriate circuit and confirm any provider access restriction. Review monitor addresses for conflicts with resolver routes. Test the firewall&#8217;s own name resolution and the client DNS service independently so a reachable public IP is not mistaken for a functioning Internet experience. Retain a resolver-to-gateway table with the circuit inventory. Have the DNS owner choose an uncached test name for the rehearsal and describe the expected upstream path for each mode. Treat a failed firewall lookup and a failed client lookup as separate findings.</p>\n<h2>Verification</h2>\n<p>During a controlled circuit-loss test, query a known external name through the intended local DNS service and inspect the outbound route to the resolver. Repeat for the other WAN and after restoration. Record failures by resolver and transport path rather than replacing several unrelated DNS settings at once.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.netgate.com/pfsense/en/latest/multiwan/interfaces-and-dns.html\">Netgate — Interface and DNS Configuration</a>. Reviewed October 20, 2026.</p>",
        "content_text": "A second Internet circuit is insufficient if all configured resolvers depend on the failed first circuit.\nSource facts\nNetgate explains that DNS forwarding uses the firewall routing table. Configured DNS servers can be associated with gateways so queries use a specific WAN, and the source calls for unique server entries rather than repeating one address for several gateways. Default recursive-resolver operation instead requires default-gateway failover for Multi-WAN resilience.\nSource: Netgate — Interface and DNS Configuration.\nApplicability\nThis concerns pfSense DNS Resolver modes and DNS Forwarder configuration.\nDSE recommendation\nDSE recommends recording whether the installation performs recursive resolution or forwards to selected servers before changing Multi-WAN DNS. For forwarding, map each resolver to an appropriate circuit and confirm any provider access restriction. Review monitor addresses for conflicts with resolver routes. Test the firewall’s own name resolution and the client DNS service independently so a reachable public IP is not mistaken for a functioning Internet experience. Retain a resolver-to-gateway table with the circuit inventory. Have the DNS owner choose an uncached test name for the rehearsal and describe the expected upstream path for each mode. Treat a failed firewall lookup and a failed client lookup as separate findings.\nVerification\nDuring a controlled circuit-loss test, query a known external name through the intended local DNS service and inspect the outbound route to the resolver. Repeat for the other WAN and after restoration. Record failures by resolver and transport path rather than replacing several unrelated DNS settings at once.\nOfficial reference\nNetgate — Interface and DNS Configuration. Reviewed October 20, 2026.",
        "content_markdown": "A second Internet circuit is insufficient if all configured resolvers depend on the failed first circuit.\n\n## Source facts\n\nNetgate explains that DNS forwarding uses the firewall routing table. Configured DNS servers can be associated with gateways so queries use a specific WAN, and the source calls for unique server entries rather than repeating one address for several gateways. Default recursive-resolver operation instead requires default-gateway failover for Multi-WAN resilience.\n\nSource: [Netgate — Interface and DNS Configuration](https://docs.netgate.com/pfsense/en/latest/multiwan/interfaces-and-dns.html).\n\n## Applicability\n\nThis concerns pfSense DNS Resolver modes and DNS Forwarder configuration.\n\n## DSE recommendation\n\nDSE recommends recording whether the installation performs recursive resolution or forwards to selected servers before changing Multi-WAN DNS. For forwarding, map each resolver to an appropriate circuit and confirm any provider access restriction. Review monitor addresses for conflicts with resolver routes. Test the firewall’s own name resolution and the client DNS service independently so a reachable public IP is not mistaken for a functioning Internet experience. Retain a resolver-to-gateway table with the circuit inventory. Have the DNS owner choose an uncached test name for the rehearsal and describe the expected upstream path for each mode. Treat a failed firewall lookup and a failed client lookup as separate findings.\n\n## Verification\n\nDuring a controlled circuit-loss test, query a known external name through the intended local DNS service and inspect the outbound route to the resolver. Repeat for the other WAN and after restoration. Record failures by resolver and transport path rather than replacing several unrelated DNS settings at once.\n\n## Official reference\n\n[Netgate — Interface and DNS Configuration](https://docs.netgate.com/pfsense/en/latest/multiwan/interfaces-and-dns.html). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/give-pfsense-forwarding-dns-a-viable-route-through-each-wan/",
                "url": "https://update.dsesecurity.com/updates/give-pfsense-forwarding-dns-a-viable-route-through-each-wan/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/give-pfsense-forwarding-dns-a-viable-route-through-each-wan/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Give pfSense forwarding DNS a viable route through each WAN",
                        "item": "https://update.dsesecurity.com/updates/give-pfsense-forwarding-dns-a-viable-route-through-each-wan/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/give-pfsense-forwarding-dns-a-viable-route-through-each-wan/#article",
                "identifier": "https://update.dsesecurity.com/updates/give-pfsense-forwarding-dns-a-viable-route-through-each-wan/",
                "url": "https://update.dsesecurity.com/updates/give-pfsense-forwarding-dns-a-viable-route-through-each-wan/",
                "headline": "Give pfSense forwarding DNS a viable route through each WAN",
                "description": "A second Internet circuit is insufficient if all configured resolvers depend on the failed first circuit.",
                "abstract": "A second Internet circuit is insufficient if all configured resolvers depend on the failed first circuit.",
                "articleBody": "A second Internet circuit is insufficient if all configured resolvers depend on the failed first circuit.\nSource facts\nNetgate explains that DNS forwarding uses the firewall routing table. Configured DNS servers can be associated with gateways so queries use a specific WAN, and the source calls for unique server entries rather than repeating one address for several gateways. Default recursive-resolver operation instead requires default-gateway failover for Multi-WAN resilience.\nSource: Netgate — Interface and DNS Configuration.\nApplicability\nThis concerns pfSense DNS Resolver modes and DNS Forwarder configuration.\nDSE recommendation\nDSE recommends recording whether the installation performs recursive resolution or forwards to selected servers before changing Multi-WAN DNS. For forwarding, map each resolver to an appropriate circuit and confirm any provider access restriction. Review monitor addresses for conflicts with resolver routes. Test the firewall’s own name resolution and the client DNS service independently so a reachable public IP is not mistaken for a functioning Internet experience. Retain a resolver-to-gateway table with the circuit inventory. Have the DNS owner choose an uncached test name for the rehearsal and describe the expected upstream path for each mode. Treat a failed firewall lookup and a failed client lookup as separate findings.\nVerification\nDuring a controlled circuit-loss test, query a known external name through the intended local DNS service and inspect the outbound route to the resolver. Repeat for the other WAN and after restoration. Record failures by resolver and transport path rather than replacing several unrelated DNS settings at once.\nOfficial reference\nNetgate — Interface and DNS Configuration. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:16:05+00:00",
                "dateModified": "2026-10-20T18:34:34+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/give-pfsense-forwarding-dns-a-viable-route-through-each-wan/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/give-pfsense-forwarding-dns-a-viable-route-through-each-wan/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Give pfSense forwarding DNS a viable route through each WAN"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 253,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Netgate — Interface and DNS Configuration",
                    "url": "https://docs.netgate.com/pfsense/en/latest/multiwan/interfaces-and-dns.html"
                }
            }
        ]
    }
}