{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/keep-pfsense-wan-reply-paths-on-actual-wan-rule-tabs/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/keep-pfsense-wan-reply-paths-on-actual-wan-rule-tabs/",
        "slug": "keep-pfsense-wan-reply-paths-on-actual-wan-rule-tabs",
        "url": "https://update.dsesecurity.com/updates/keep-pfsense-wan-reply-paths-on-actual-wan-rule-tabs/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/keep-pfsense-wan-reply-paths-on-actual-wan-rule-tabs.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/keep-pfsense-wan-reply-paths-on-actual-wan-rule-tabs/"
        },
        "title": "Keep pfSense WAN reply paths on actual WAN rule tabs",
        "summary": "A convenient group tab does not receive the same reply-to treatment as a WAN interface tab.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:16:19+00:00",
        "modified_at": "2026-10-20T18:34:35+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 248,
        "potentially_affected": "This concerns pfSense interface-group rules on multiple WANs.",
        "dse_recommendation": "DSE recommends keeping externally initiated service permissions on the relevant WAN tabs when the design relies on correct symmetric replies.",
        "primary_source": {
            "name": "Netgate — Interface Groups",
            "url": "https://docs.netgate.com/pfsense/en/latest/interfaces/groups.html",
            "published_on": null,
            "authority": "docs.netgate.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A convenient group tab does not receive the same reply-to treatment as a WAN interface tab.</p>\n<h2>Source facts</h2>\n<p>Netgate advises against combining multiple WANs in interface groups. Rules on actual WAN-type interfaces receive reply-to handling so responses leave through the interface where the connection arrived. Group rules do not receive that handling and generally behave as expected only for the WAN using the default gateway.</p>\n<p>Source: <a href=\"https://docs.netgate.com/pfsense/en/latest/interfaces/groups.html\">Netgate — Interface Groups</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns pfSense interface-group rules on multiple WANs.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends keeping externally initiated service permissions on the relevant WAN tabs when the design relies on correct symmetric replies. If consolidating repetitive rules, review the packet-return behavior before choosing a group for convenience. Document why a shared internal group is appropriate and why a WAN exception remains separate. Include published services on non-default WANs in acceptance tests rather than checking only the preferred Internet connection. Require one genuinely external test connection through each WAN, with the responding interface identified. Keep a shared description or maintenance checklist for equivalent WAN rules if helpful, but review the actual per-interface entries and their return path before accepting a convenience-based consolidation.</p>\n<h2>Verification</h2>\n<p>From authorized external locations, initiate new connections through each WAN and inspect the return interface. Compare the active rule and state with the intended WAN-tab configuration. Confirm that a service on a non-default WAN replies through that same circuit instead of concluding success from a test that used only the default WAN.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.netgate.com/pfsense/en/latest/interfaces/groups.html\">Netgate — Interface Groups</a>. Reviewed October 20, 2026.</p>",
        "content_text": "A convenient group tab does not receive the same reply-to treatment as a WAN interface tab.\nSource facts\nNetgate advises against combining multiple WANs in interface groups. Rules on actual WAN-type interfaces receive reply-to handling so responses leave through the interface where the connection arrived. Group rules do not receive that handling and generally behave as expected only for the WAN using the default gateway.\nSource: Netgate — Interface Groups.\nApplicability\nThis concerns pfSense interface-group rules on multiple WANs.\nDSE recommendation\nDSE recommends keeping externally initiated service permissions on the relevant WAN tabs when the design relies on correct symmetric replies. If consolidating repetitive rules, review the packet-return behavior before choosing a group for convenience. Document why a shared internal group is appropriate and why a WAN exception remains separate. Include published services on non-default WANs in acceptance tests rather than checking only the preferred Internet connection. Require one genuinely external test connection through each WAN, with the responding interface identified. Keep a shared description or maintenance checklist for equivalent WAN rules if helpful, but review the actual per-interface entries and their return path before accepting a convenience-based consolidation.\nVerification\nFrom authorized external locations, initiate new connections through each WAN and inspect the return interface. Compare the active rule and state with the intended WAN-tab configuration. Confirm that a service on a non-default WAN replies through that same circuit instead of concluding success from a test that used only the default WAN.\nOfficial reference\nNetgate — Interface Groups. Reviewed October 20, 2026.",
        "content_markdown": "A convenient group tab does not receive the same reply-to treatment as a WAN interface tab.\n\n## Source facts\n\nNetgate advises against combining multiple WANs in interface groups. Rules on actual WAN-type interfaces receive reply-to handling so responses leave through the interface where the connection arrived. Group rules do not receive that handling and generally behave as expected only for the WAN using the default gateway.\n\nSource: [Netgate — Interface Groups](https://docs.netgate.com/pfsense/en/latest/interfaces/groups.html).\n\n## Applicability\n\nThis concerns pfSense interface-group rules on multiple WANs.\n\n## DSE recommendation\n\nDSE recommends keeping externally initiated service permissions on the relevant WAN tabs when the design relies on correct symmetric replies. If consolidating repetitive rules, review the packet-return behavior before choosing a group for convenience. Document why a shared internal group is appropriate and why a WAN exception remains separate. Include published services on non-default WANs in acceptance tests rather than checking only the preferred Internet connection. Require one genuinely external test connection through each WAN, with the responding interface identified. Keep a shared description or maintenance checklist for equivalent WAN rules if helpful, but review the actual per-interface entries and their return path before accepting a convenience-based consolidation.\n\n## Verification\n\nFrom authorized external locations, initiate new connections through each WAN and inspect the return interface. Compare the active rule and state with the intended WAN-tab configuration. Confirm that a service on a non-default WAN replies through that same circuit instead of concluding success from a test that used only the default WAN.\n\n## Official reference\n\n[Netgate — Interface Groups](https://docs.netgate.com/pfsense/en/latest/interfaces/groups.html). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/keep-pfsense-wan-reply-paths-on-actual-wan-rule-tabs/",
                "url": "https://update.dsesecurity.com/updates/keep-pfsense-wan-reply-paths-on-actual-wan-rule-tabs/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/keep-pfsense-wan-reply-paths-on-actual-wan-rule-tabs/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Keep pfSense WAN reply paths on actual WAN rule tabs",
                        "item": "https://update.dsesecurity.com/updates/keep-pfsense-wan-reply-paths-on-actual-wan-rule-tabs/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/keep-pfsense-wan-reply-paths-on-actual-wan-rule-tabs/#article",
                "identifier": "https://update.dsesecurity.com/updates/keep-pfsense-wan-reply-paths-on-actual-wan-rule-tabs/",
                "url": "https://update.dsesecurity.com/updates/keep-pfsense-wan-reply-paths-on-actual-wan-rule-tabs/",
                "headline": "Keep pfSense WAN reply paths on actual WAN rule tabs",
                "description": "A convenient group tab does not receive the same reply-to treatment as a WAN interface tab.",
                "abstract": "A convenient group tab does not receive the same reply-to treatment as a WAN interface tab.",
                "articleBody": "A convenient group tab does not receive the same reply-to treatment as a WAN interface tab.\nSource facts\nNetgate advises against combining multiple WANs in interface groups. Rules on actual WAN-type interfaces receive reply-to handling so responses leave through the interface where the connection arrived. Group rules do not receive that handling and generally behave as expected only for the WAN using the default gateway.\nSource: Netgate — Interface Groups.\nApplicability\nThis concerns pfSense interface-group rules on multiple WANs.\nDSE recommendation\nDSE recommends keeping externally initiated service permissions on the relevant WAN tabs when the design relies on correct symmetric replies. If consolidating repetitive rules, review the packet-return behavior before choosing a group for convenience. Document why a shared internal group is appropriate and why a WAN exception remains separate. Include published services on non-default WANs in acceptance tests rather than checking only the preferred Internet connection. Require one genuinely external test connection through each WAN, with the responding interface identified. Keep a shared description or maintenance checklist for equivalent WAN rules if helpful, but review the actual per-interface entries and their return path before accepting a convenience-based consolidation.\nVerification\nFrom authorized external locations, initiate new connections through each WAN and inspect the return interface. Compare the active rule and state with the intended WAN-tab configuration. Confirm that a service on a non-default WAN replies through that same circuit instead of concluding success from a test that used only the default WAN.\nOfficial reference\nNetgate — Interface Groups. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:16:19+00:00",
                "dateModified": "2026-10-20T18:34:35+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/keep-pfsense-wan-reply-paths-on-actual-wan-rule-tabs/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/keep-pfsense-wan-reply-paths-on-actual-wan-rule-tabs/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Keep pfSense WAN reply paths on actual WAN rule tabs"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 248,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Netgate — Interface Groups",
                    "url": "https://docs.netgate.com/pfsense/en/latest/interfaces/groups.html"
                }
            }
        ]
    }
}