{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/keep-pfsense-s-generated-qinq-interface-group-under-the-qinq-configuration-s-control/", "item": { "id": "https://update.dsesecurity.com/updates/keep-pfsense-s-generated-qinq-interface-group-under-the-qinq-configuration-s-control/", "slug": "keep-pfsense-s-generated-qinq-interface-group-under-the-qinq-configuration-s-control", "url": "https://update.dsesecurity.com/updates/keep-pfsense-s-generated-qinq-interface-group-under-the-qinq-configuration-s-control/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/keep-pfsense-s-generated-qinq-interface-group-under-the-qinq-configuration-s-control.md", "json": "https://update.dsesecurity.com/api/v1/posts/keep-pfsense-s-generated-qinq-interface-group-under-the-qinq-configuration-s-control/" }, "title": "Keep pfSense's generated QinQ interface group under the QinQ configuration's control", "summary": "Manually altering the automatic group can break it because its interfaces are not ordinary assigned members.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:10+00:00", "modified_at": "2026-10-20T18:34:34+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 254, "potentially_affected": "This concerns pfSense's generated QinQ grouping and its documented recreation method.", "dse_recommendation": "DSE recommends recording outer tag, inner member range, tag type, and endpoint mapping in one service worksheet.", "primary_source": { "name": "Netgate — QinQ Configuration", "url": "https://docs.netgate.com/pfsense/en/latest/interfaces/qinq.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Manually altering the automatic group can break it because its interfaces are not ordinary assigned members.

\n

Source facts

\n

Netgate describes QinQ as nested VLAN tags with an outer provider tag carrying member VLANs. Its optional generated QinQ interface group permits shared filtering across subinterfaces. The guide warns not to edit that automatic group manually; to recreate it, delete the group and edit and save the QinQ instance again.

\n

Source: Netgate — QinQ Configuration.

\n

Applicability

\n

This concerns pfSense’s generated QinQ grouping and its documented recreation method.

\n

DSE recommendation

\n

DSE recommends recording outer tag, inner member range, tag type, and endpoint mapping in one service worksheet. Manage generated group membership from the QinQ object rather than treating it as a normal hand-maintained group. Limit shared rules to the intended member population. Coordinate any recreation with the remote endpoint owner and preserve the previous configuration so a maintenance action does not unexpectedly affect every carried VLAN. Ask the network owner to identify the QinQ instance responsible for the generated group before any membership cleanup. Keep the outer tag and representative inner tags in the same acceptance record. Treat a proposed hand edit as a design question rather than routine group maintenance.

\n

Verification

\n

In a lab or approved maintenance window, compare the generated group with the intended member range. Test one permitted flow in each representative inner VLAN and one prohibited cross-VLAN flow. Confirm stacked tags at the transport boundary and verify that group recreation restores the intended filtering tab and membership.

\n

Official reference

\n

Netgate — QinQ Configuration. Reviewed October 20, 2026.

", "content_text": "Manually altering the automatic group can break it because its interfaces are not ordinary assigned members.\nSource facts\nNetgate describes QinQ as nested VLAN tags with an outer provider tag carrying member VLANs. Its optional generated QinQ interface group permits shared filtering across subinterfaces. The guide warns not to edit that automatic group manually; to recreate it, delete the group and edit and save the QinQ instance again.\nSource: Netgate — QinQ Configuration.\nApplicability\nThis concerns pfSense’s generated QinQ grouping and its documented recreation method.\nDSE recommendation\nDSE recommends recording outer tag, inner member range, tag type, and endpoint mapping in one service worksheet. Manage generated group membership from the QinQ object rather than treating it as a normal hand-maintained group. Limit shared rules to the intended member population. Coordinate any recreation with the remote endpoint owner and preserve the previous configuration so a maintenance action does not unexpectedly affect every carried VLAN. Ask the network owner to identify the QinQ instance responsible for the generated group before any membership cleanup. Keep the outer tag and representative inner tags in the same acceptance record. Treat a proposed hand edit as a design question rather than routine group maintenance.\nVerification\nIn a lab or approved maintenance window, compare the generated group with the intended member range. Test one permitted flow in each representative inner VLAN and one prohibited cross-VLAN flow. Confirm stacked tags at the transport boundary and verify that group recreation restores the intended filtering tab and membership.\nOfficial reference\nNetgate — QinQ Configuration. Reviewed October 20, 2026.", "content_markdown": "Manually altering the automatic group can break it because its interfaces are not ordinary assigned members.\n\n## Source facts\n\nNetgate describes QinQ as nested VLAN tags with an outer provider tag carrying member VLANs. Its optional generated QinQ interface group permits shared filtering across subinterfaces. The guide warns not to edit that automatic group manually; to recreate it, delete the group and edit and save the QinQ instance again.\n\nSource: [Netgate — QinQ Configuration](https://docs.netgate.com/pfsense/en/latest/interfaces/qinq.html).\n\n## Applicability\n\nThis concerns pfSense’s generated QinQ grouping and its documented recreation method.\n\n## DSE recommendation\n\nDSE recommends recording outer tag, inner member range, tag type, and endpoint mapping in one service worksheet. Manage generated group membership from the QinQ object rather than treating it as a normal hand-maintained group. Limit shared rules to the intended member population. Coordinate any recreation with the remote endpoint owner and preserve the previous configuration so a maintenance action does not unexpectedly affect every carried VLAN. Ask the network owner to identify the QinQ instance responsible for the generated group before any membership cleanup. Keep the outer tag and representative inner tags in the same acceptance record. Treat a proposed hand edit as a design question rather than routine group maintenance.\n\n## Verification\n\nIn a lab or approved maintenance window, compare the generated group with the intended member range. Test one permitted flow in each representative inner VLAN and one prohibited cross-VLAN flow. Confirm stacked tags at the transport boundary and verify that group recreation restores the intended filtering tab and membership.\n\n## Official reference\n\n[Netgate — QinQ Configuration](https://docs.netgate.com/pfsense/en/latest/interfaces/qinq.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/keep-pfsense-s-generated-qinq-interface-group-under-the-qinq-configuration-s-control/", "url": "https://update.dsesecurity.com/updates/keep-pfsense-s-generated-qinq-interface-group-under-the-qinq-configuration-s-control/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/keep-pfsense-s-generated-qinq-interface-group-under-the-qinq-configuration-s-control/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Keep pfSense's generated QinQ interface group under the QinQ configuration's control", "item": "https://update.dsesecurity.com/updates/keep-pfsense-s-generated-qinq-interface-group-under-the-qinq-configuration-s-control/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/keep-pfsense-s-generated-qinq-interface-group-under-the-qinq-configuration-s-control/#article", "identifier": "https://update.dsesecurity.com/updates/keep-pfsense-s-generated-qinq-interface-group-under-the-qinq-configuration-s-control/", "url": "https://update.dsesecurity.com/updates/keep-pfsense-s-generated-qinq-interface-group-under-the-qinq-configuration-s-control/", "headline": "Keep pfSense's generated QinQ interface group under the QinQ configuration's control", "description": "Manually altering the automatic group can break it because its interfaces are not ordinary assigned members.", "abstract": "Manually altering the automatic group can break it because its interfaces are not ordinary assigned members.", "articleBody": "Manually altering the automatic group can break it because its interfaces are not ordinary assigned members.\nSource facts\nNetgate describes QinQ as nested VLAN tags with an outer provider tag carrying member VLANs. Its optional generated QinQ interface group permits shared filtering across subinterfaces. The guide warns not to edit that automatic group manually; to recreate it, delete the group and edit and save the QinQ instance again.\nSource: Netgate — QinQ Configuration.\nApplicability\nThis concerns pfSense’s generated QinQ grouping and its documented recreation method.\nDSE recommendation\nDSE recommends recording outer tag, inner member range, tag type, and endpoint mapping in one service worksheet. Manage generated group membership from the QinQ object rather than treating it as a normal hand-maintained group. Limit shared rules to the intended member population. Coordinate any recreation with the remote endpoint owner and preserve the previous configuration so a maintenance action does not unexpectedly affect every carried VLAN. Ask the network owner to identify the QinQ instance responsible for the generated group before any membership cleanup. Keep the outer tag and representative inner tags in the same acceptance record. Treat a proposed hand edit as a design question rather than routine group maintenance.\nVerification\nIn a lab or approved maintenance window, compare the generated group with the intended member range. Test one permitted flow in each representative inner VLAN and one prohibited cross-VLAN flow. Confirm stacked tags at the transport boundary and verify that group recreation restores the intended filtering tab and membership.\nOfficial reference\nNetgate — QinQ Configuration. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:10+00:00", "dateModified": "2026-10-20T18:34:34+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/keep-pfsense-s-generated-qinq-interface-group-under-the-qinq-configuration-s-control/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/keep-pfsense-s-generated-qinq-interface-group-under-the-qinq-configuration-s-control/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep pfSense's generated QinQ interface group under the QinQ configuration's control" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 254, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — QinQ Configuration", "url": "https://docs.netgate.com/pfsense/en/latest/interfaces/qinq.html" } } ] } }