{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/make-pfsense-floating-rule-quick-behavior-explicit/", "item": { "id": "https://update.dsesecurity.com/updates/make-pfsense-floating-rule-quick-behavior-explicit/", "slug": "make-pfsense-floating-rule-quick-behavior-explicit", "url": "https://update.dsesecurity.com/updates/make-pfsense-floating-rule-quick-behavior-explicit/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/make-pfsense-floating-rule-quick-behavior-explicit.md", "json": "https://update.dsesecurity.com/api/v1/posts/make-pfsense-floating-rule-quick-behavior-explicit/" }, "title": "Make pfSense floating-rule Quick behavior explicit", "summary": "Floating rules can use last-match behavior, so an early visual position alone does not settle the outcome.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:15:53+00:00", "modified_at": "2026-10-20T18:34:34+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 251, "potentially_affected": "This applies to pfSense floating rules and their direction-specific packet view.", "dse_recommendation": "DSE recommends recording the intended first-match or last-match design in each advanced rule's description.", "primary_source": { "name": "Netgate — Floating Rules", "url": "https://docs.netgate.com/pfsense/en/latest/firewall/floating-rules.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Floating rules can use last-match behavior, so an early visual position alone does not settle the outcome.

\n

Source facts

\n

Netgate explains that Quick stops further rule processing after a floating-rule match. Without Quick, a later matching rule can determine the result. Outbound floating rules on a WAN see the post-NAT source address; an inbound tag can preserve the association needed to match a particular internal workload later.

\n

Source: Netgate — Floating Rules.

\n

Applicability

\n

This applies to pfSense floating rules and their direction-specific packet view.

\n

DSE recommendation

\n

DSE recommends recording the intended first-match or last-match design in each advanced rule’s description. Use ordinary interface rules when they express the requirement clearly. For an outbound rule intended to affect one internal host, establish which address it will actually see and consider an inbound tag rather than matching an address already translated away. Keep the tagging rule and consuming rule linked in the change record so a later cleanup does not silently detach them. For a last-match design, nominate the later rule expected to win and test a packet matching both entries. Retain the Quick setting and tag relationship with that result; a screenshot of rule order without those properties is insufficient for acceptance.

\n

Verification

\n

Generate separate approved test flows from the targeted host and an untargeted peer. Review rule counters, the translated source, and the final pass or block result. Repeat after a fresh connection so an existing state is not mistaken for the new rule’s decision.

\n

Official reference

\n

Netgate — Floating Rules. Reviewed October 20, 2026.

", "content_text": "Floating rules can use last-match behavior, so an early visual position alone does not settle the outcome.\nSource facts\nNetgate explains that Quick stops further rule processing after a floating-rule match. Without Quick, a later matching rule can determine the result. Outbound floating rules on a WAN see the post-NAT source address; an inbound tag can preserve the association needed to match a particular internal workload later.\nSource: Netgate — Floating Rules.\nApplicability\nThis applies to pfSense floating rules and their direction-specific packet view.\nDSE recommendation\nDSE recommends recording the intended first-match or last-match design in each advanced rule’s description. Use ordinary interface rules when they express the requirement clearly. For an outbound rule intended to affect one internal host, establish which address it will actually see and consider an inbound tag rather than matching an address already translated away. Keep the tagging rule and consuming rule linked in the change record so a later cleanup does not silently detach them. For a last-match design, nominate the later rule expected to win and test a packet matching both entries. Retain the Quick setting and tag relationship with that result; a screenshot of rule order without those properties is insufficient for acceptance.\nVerification\nGenerate separate approved test flows from the targeted host and an untargeted peer. Review rule counters, the translated source, and the final pass or block result. Repeat after a fresh connection so an existing state is not mistaken for the new rule’s decision.\nOfficial reference\nNetgate — Floating Rules. Reviewed October 20, 2026.", "content_markdown": "Floating rules can use last-match behavior, so an early visual position alone does not settle the outcome.\n\n## Source facts\n\nNetgate explains that Quick stops further rule processing after a floating-rule match. Without Quick, a later matching rule can determine the result. Outbound floating rules on a WAN see the post-NAT source address; an inbound tag can preserve the association needed to match a particular internal workload later.\n\nSource: [Netgate — Floating Rules](https://docs.netgate.com/pfsense/en/latest/firewall/floating-rules.html).\n\n## Applicability\n\nThis applies to pfSense floating rules and their direction-specific packet view.\n\n## DSE recommendation\n\nDSE recommends recording the intended first-match or last-match design in each advanced rule’s description. Use ordinary interface rules when they express the requirement clearly. For an outbound rule intended to affect one internal host, establish which address it will actually see and consider an inbound tag rather than matching an address already translated away. Keep the tagging rule and consuming rule linked in the change record so a later cleanup does not silently detach them. For a last-match design, nominate the later rule expected to win and test a packet matching both entries. Retain the Quick setting and tag relationship with that result; a screenshot of rule order without those properties is insufficient for acceptance.\n\n## Verification\n\nGenerate separate approved test flows from the targeted host and an untargeted peer. Review rule counters, the translated source, and the final pass or block result. Repeat after a fresh connection so an existing state is not mistaken for the new rule’s decision.\n\n## Official reference\n\n[Netgate — Floating Rules](https://docs.netgate.com/pfsense/en/latest/firewall/floating-rules.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/make-pfsense-floating-rule-quick-behavior-explicit/", "url": "https://update.dsesecurity.com/updates/make-pfsense-floating-rule-quick-behavior-explicit/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/make-pfsense-floating-rule-quick-behavior-explicit/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Make pfSense floating-rule Quick behavior explicit", "item": "https://update.dsesecurity.com/updates/make-pfsense-floating-rule-quick-behavior-explicit/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/make-pfsense-floating-rule-quick-behavior-explicit/#article", "identifier": "https://update.dsesecurity.com/updates/make-pfsense-floating-rule-quick-behavior-explicit/", "url": "https://update.dsesecurity.com/updates/make-pfsense-floating-rule-quick-behavior-explicit/", "headline": "Make pfSense floating-rule Quick behavior explicit", "description": "Floating rules can use last-match behavior, so an early visual position alone does not settle the outcome.", "abstract": "Floating rules can use last-match behavior, so an early visual position alone does not settle the outcome.", "articleBody": "Floating rules can use last-match behavior, so an early visual position alone does not settle the outcome.\nSource facts\nNetgate explains that Quick stops further rule processing after a floating-rule match. Without Quick, a later matching rule can determine the result. Outbound floating rules on a WAN see the post-NAT source address; an inbound tag can preserve the association needed to match a particular internal workload later.\nSource: Netgate — Floating Rules.\nApplicability\nThis applies to pfSense floating rules and their direction-specific packet view.\nDSE recommendation\nDSE recommends recording the intended first-match or last-match design in each advanced rule’s description. Use ordinary interface rules when they express the requirement clearly. For an outbound rule intended to affect one internal host, establish which address it will actually see and consider an inbound tag rather than matching an address already translated away. Keep the tagging rule and consuming rule linked in the change record so a later cleanup does not silently detach them. For a last-match design, nominate the later rule expected to win and test a packet matching both entries. Retain the Quick setting and tag relationship with that result; a screenshot of rule order without those properties is insufficient for acceptance.\nVerification\nGenerate separate approved test flows from the targeted host and an untargeted peer. Review rule counters, the translated source, and the final pass or block result. Repeat after a fresh connection so an existing state is not mistaken for the new rule’s decision.\nOfficial reference\nNetgate — Floating Rules. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:15:53+00:00", "dateModified": "2026-10-20T18:34:34+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/make-pfsense-floating-rule-quick-behavior-explicit/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/make-pfsense-floating-rule-quick-behavior-explicit/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Make pfSense floating-rule Quick behavior explicit" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 251, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — Floating Rules", "url": "https://docs.netgate.com/pfsense/en/latest/firewall/floating-rules.html" } } ] } }