{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/label-pfsense-packet-captures-with-the-nat-stage-they-observe/", "item": { "id": "https://update.dsesecurity.com/updates/label-pfsense-packet-captures-with-the-nat-stage-they-observe/", "slug": "label-pfsense-packet-captures-with-the-nat-stage-they-observe", "url": "https://update.dsesecurity.com/updates/label-pfsense-packet-captures-with-the-nat-stage-they-observe/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/label-pfsense-packet-captures-with-the-nat-stage-they-observe.md", "json": "https://update.dsesecurity.com/api/v1/posts/label-pfsense-packet-captures-with-the-nat-stage-they-observe/" }, "title": "Label pfSense packet captures with the NAT stage they observe", "summary": "A capture and a firewall rule may legitimately show different addresses for the same flow.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:15:58+00:00", "modified_at": "2026-10-20T18:34:34+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 254, "potentially_affected": "This concerns the documented logical PF processing path in pfSense.", "dse_recommendation": "DSE recommends tracing one connection from ingress to egress with its original and translated address pairs written explicitly.", "primary_source": { "name": "Netgate — Ordering of NAT and Firewall Processing", "url": "https://docs.netgate.com/pfsense/en/latest/nat/process-order.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A capture and a firewall rule may legitimately show different addresses for the same flow.

\n

Source facts

\n

Netgate places inbound destination translation before interface filtering and outbound source translation before outbound floating rules. Its processing example also shows that WAN interface rules do not filter a connection merely because a LAN-originated packet later exits WAN. The capture hook sees packets before inbound processing and after outbound processing.

\n

Source: Netgate — Ordering of NAT and Firewall Processing.

\n

Applicability

\n

This concerns the documented logical PF processing path in pfSense.

\n

DSE recommendation

\n

DSE recommends tracing one connection from ingress to egress with its original and translated address pairs written explicitly. Label evidence with interface, direction, and timestamp rather than attaching an unlabeled packet screenshot. When a rule counter stays unchanged, confirm that the rule belongs to a stage the packet actually traverses. Avoid adding duplicate WAN rules to compensate for a misunderstanding of LAN-originated filtering. Use one small evidence diagram with the original tuple, each translated tuple, and the observation point. Ask another engineer to predict the two captures from that diagram before seeing the results; reconcile any disagreement before changing a rule that may be functioning correctly.

\n

Verification

\n

Capture a narrowly filtered approved test flow on both relevant interfaces. Correlate ports and timestamps with the active NAT and filter entries. Check that the expected translation appears at the correct boundary and that the applicable ingress rule, rather than an unrelated egress-tab rule, makes the permission decision.

\n

Official reference

\n

Netgate — Ordering of NAT and Firewall Processing. Reviewed October 20, 2026.

", "content_text": "A capture and a firewall rule may legitimately show different addresses for the same flow.\nSource facts\nNetgate places inbound destination translation before interface filtering and outbound source translation before outbound floating rules. Its processing example also shows that WAN interface rules do not filter a connection merely because a LAN-originated packet later exits WAN. The capture hook sees packets before inbound processing and after outbound processing.\nSource: Netgate — Ordering of NAT and Firewall Processing.\nApplicability\nThis concerns the documented logical PF processing path in pfSense.\nDSE recommendation\nDSE recommends tracing one connection from ingress to egress with its original and translated address pairs written explicitly. Label evidence with interface, direction, and timestamp rather than attaching an unlabeled packet screenshot. When a rule counter stays unchanged, confirm that the rule belongs to a stage the packet actually traverses. Avoid adding duplicate WAN rules to compensate for a misunderstanding of LAN-originated filtering. Use one small evidence diagram with the original tuple, each translated tuple, and the observation point. Ask another engineer to predict the two captures from that diagram before seeing the results; reconcile any disagreement before changing a rule that may be functioning correctly.\nVerification\nCapture a narrowly filtered approved test flow on both relevant interfaces. Correlate ports and timestamps with the active NAT and filter entries. Check that the expected translation appears at the correct boundary and that the applicable ingress rule, rather than an unrelated egress-tab rule, makes the permission decision.\nOfficial reference\nNetgate — Ordering of NAT and Firewall Processing. Reviewed October 20, 2026.", "content_markdown": "A capture and a firewall rule may legitimately show different addresses for the same flow.\n\n## Source facts\n\nNetgate places inbound destination translation before interface filtering and outbound source translation before outbound floating rules. Its processing example also shows that WAN interface rules do not filter a connection merely because a LAN-originated packet later exits WAN. The capture hook sees packets before inbound processing and after outbound processing.\n\nSource: [Netgate — Ordering of NAT and Firewall Processing](https://docs.netgate.com/pfsense/en/latest/nat/process-order.html).\n\n## Applicability\n\nThis concerns the documented logical PF processing path in pfSense.\n\n## DSE recommendation\n\nDSE recommends tracing one connection from ingress to egress with its original and translated address pairs written explicitly. Label evidence with interface, direction, and timestamp rather than attaching an unlabeled packet screenshot. When a rule counter stays unchanged, confirm that the rule belongs to a stage the packet actually traverses. Avoid adding duplicate WAN rules to compensate for a misunderstanding of LAN-originated filtering. Use one small evidence diagram with the original tuple, each translated tuple, and the observation point. Ask another engineer to predict the two captures from that diagram before seeing the results; reconcile any disagreement before changing a rule that may be functioning correctly.\n\n## Verification\n\nCapture a narrowly filtered approved test flow on both relevant interfaces. Correlate ports and timestamps with the active NAT and filter entries. Check that the expected translation appears at the correct boundary and that the applicable ingress rule, rather than an unrelated egress-tab rule, makes the permission decision.\n\n## Official reference\n\n[Netgate — Ordering of NAT and Firewall Processing](https://docs.netgate.com/pfsense/en/latest/nat/process-order.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/label-pfsense-packet-captures-with-the-nat-stage-they-observe/", "url": "https://update.dsesecurity.com/updates/label-pfsense-packet-captures-with-the-nat-stage-they-observe/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/label-pfsense-packet-captures-with-the-nat-stage-they-observe/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Label pfSense packet captures with the NAT stage they observe", "item": "https://update.dsesecurity.com/updates/label-pfsense-packet-captures-with-the-nat-stage-they-observe/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/label-pfsense-packet-captures-with-the-nat-stage-they-observe/#article", "identifier": "https://update.dsesecurity.com/updates/label-pfsense-packet-captures-with-the-nat-stage-they-observe/", "url": "https://update.dsesecurity.com/updates/label-pfsense-packet-captures-with-the-nat-stage-they-observe/", "headline": "Label pfSense packet captures with the NAT stage they observe", "description": "A capture and a firewall rule may legitimately show different addresses for the same flow.", "abstract": "A capture and a firewall rule may legitimately show different addresses for the same flow.", "articleBody": "A capture and a firewall rule may legitimately show different addresses for the same flow.\nSource facts\nNetgate places inbound destination translation before interface filtering and outbound source translation before outbound floating rules. Its processing example also shows that WAN interface rules do not filter a connection merely because a LAN-originated packet later exits WAN. The capture hook sees packets before inbound processing and after outbound processing.\nSource: Netgate — Ordering of NAT and Firewall Processing.\nApplicability\nThis concerns the documented logical PF processing path in pfSense.\nDSE recommendation\nDSE recommends tracing one connection from ingress to egress with its original and translated address pairs written explicitly. Label evidence with interface, direction, and timestamp rather than attaching an unlabeled packet screenshot. When a rule counter stays unchanged, confirm that the rule belongs to a stage the packet actually traverses. Avoid adding duplicate WAN rules to compensate for a misunderstanding of LAN-originated filtering. Use one small evidence diagram with the original tuple, each translated tuple, and the observation point. Ask another engineer to predict the two captures from that diagram before seeing the results; reconcile any disagreement before changing a rule that may be functioning correctly.\nVerification\nCapture a narrowly filtered approved test flow on both relevant interfaces. Correlate ports and timestamps with the active NAT and filter entries. Check that the expected translation appears at the correct boundary and that the applicable ingress rule, rather than an unrelated egress-tab rule, makes the permission decision.\nOfficial reference\nNetgate — Ordering of NAT and Firewall Processing. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:15:58+00:00", "dateModified": "2026-10-20T18:34:34+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/label-pfsense-packet-captures-with-the-nat-stage-they-observe/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/label-pfsense-packet-captures-with-the-nat-stage-they-observe/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Label pfSense packet captures with the NAT stage they observe" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 254, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — Ordering of NAT and Firewall Processing", "url": "https://docs.netgate.com/pfsense/en/latest/nat/process-order.html" } } ] } }