{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/pair-pfsense-ethernet-rule-exceptions-in-both-directions-when-required/", "item": { "id": "https://update.dsesecurity.com/updates/pair-pfsense-ethernet-rule-exceptions-in-both-directions-when-required/", "slug": "pair-pfsense-ethernet-rule-exceptions-in-both-directions-when-required", "url": "https://update.dsesecurity.com/updates/pair-pfsense-ethernet-rule-exceptions-in-both-directions-when-required/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/pair-pfsense-ethernet-rule-exceptions-in-both-directions-when-required.md", "json": "https://update.dsesecurity.com/api/v1/posts/pair-pfsense-ethernet-rule-exceptions-in-both-directions-when-required/" }, "title": "Pair pfSense Ethernet-rule exceptions in both directions when required", "summary": "Layer 2 rules are stateless and cannot match on interfaces that do not carry Ethernet information.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:04+00:00", "modified_at": "2026-10-20T18:34:34+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 251, "potentially_affected": "This concerns the documented pfSense Plus Ethernet-rule feature.", "dse_recommendation": "DSE recommends identifying the actual Ethernet boundary before using MAC or EtherType criteria.", "primary_source": { "name": "Netgate — Ethernet (Layer 2) Rules", "url": "https://docs.netgate.com/pfsense/en/latest/firewall/ethernet-rules.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Layer 2 rules are stateless and cannot match on interfaces that do not carry Ethernet information.

\n

Source facts

\n

Netgate documents Ethernet rules as stateless. An exception to a block may need inbound and outbound rules with reversed source and destination. The source warns that applying an Ethernet rule to a non-Layer-2 tunnel produces no error even though it cannot match. Manual Ethernet rules are evaluated before automatically managed captive-portal rules.

\n

Source: Netgate — Ethernet (Layer 2) Rules.

\n

Applicability

\n

This concerns the documented pfSense Plus Ethernet-rule feature.

\n

DSE recommendation

\n

DSE recommends identifying the actual Ethernet boundary before using MAC or EtherType criteria. Describe the reverse direction explicitly and check whether an exception must cover it. Review any captive-portal interface for interference before enabling a broad manual rule. Avoid using a silent absence of errors as evidence that a rule is active. Keep a recovery connection available when changing Layer 2 admission because mistakes can affect supporting traffic as well as application packets. For every proposed exception, put the forward and reverse header criteria beside each other for review. Include one unsuitable interface as a design check, not an uncontrolled production experiment, and require a positive counter or capture before declaring a Layer 2 rule effective.

\n

Verification

\n

On an isolated test path, generate both directions of the intended exchange and inspect rule counters or captures. Try the intended denied traffic separately. Confirm that the selected interface carries Layer 2 headers and that portal behavior, if present, still follows the approved workflow.

\n

Official reference

\n

Netgate — Ethernet (Layer 2) Rules. Reviewed October 20, 2026.

", "content_text": "Layer 2 rules are stateless and cannot match on interfaces that do not carry Ethernet information.\nSource facts\nNetgate documents Ethernet rules as stateless. An exception to a block may need inbound and outbound rules with reversed source and destination. The source warns that applying an Ethernet rule to a non-Layer-2 tunnel produces no error even though it cannot match. Manual Ethernet rules are evaluated before automatically managed captive-portal rules.\nSource: Netgate — Ethernet (Layer 2) Rules.\nApplicability\nThis concerns the documented pfSense Plus Ethernet-rule feature.\nDSE recommendation\nDSE recommends identifying the actual Ethernet boundary before using MAC or EtherType criteria. Describe the reverse direction explicitly and check whether an exception must cover it. Review any captive-portal interface for interference before enabling a broad manual rule. Avoid using a silent absence of errors as evidence that a rule is active. Keep a recovery connection available when changing Layer 2 admission because mistakes can affect supporting traffic as well as application packets. For every proposed exception, put the forward and reverse header criteria beside each other for review. Include one unsuitable interface as a design check, not an uncontrolled production experiment, and require a positive counter or capture before declaring a Layer 2 rule effective.\nVerification\nOn an isolated test path, generate both directions of the intended exchange and inspect rule counters or captures. Try the intended denied traffic separately. Confirm that the selected interface carries Layer 2 headers and that portal behavior, if present, still follows the approved workflow.\nOfficial reference\nNetgate — Ethernet (Layer 2) Rules. Reviewed October 20, 2026.", "content_markdown": "Layer 2 rules are stateless and cannot match on interfaces that do not carry Ethernet information.\n\n## Source facts\n\nNetgate documents Ethernet rules as stateless. An exception to a block may need inbound and outbound rules with reversed source and destination. The source warns that applying an Ethernet rule to a non-Layer-2 tunnel produces no error even though it cannot match. Manual Ethernet rules are evaluated before automatically managed captive-portal rules.\n\nSource: [Netgate — Ethernet (Layer 2) Rules](https://docs.netgate.com/pfsense/en/latest/firewall/ethernet-rules.html).\n\n## Applicability\n\nThis concerns the documented pfSense Plus Ethernet-rule feature.\n\n## DSE recommendation\n\nDSE recommends identifying the actual Ethernet boundary before using MAC or EtherType criteria. Describe the reverse direction explicitly and check whether an exception must cover it. Review any captive-portal interface for interference before enabling a broad manual rule. Avoid using a silent absence of errors as evidence that a rule is active. Keep a recovery connection available when changing Layer 2 admission because mistakes can affect supporting traffic as well as application packets. For every proposed exception, put the forward and reverse header criteria beside each other for review. Include one unsuitable interface as a design check, not an uncontrolled production experiment, and require a positive counter or capture before declaring a Layer 2 rule effective.\n\n## Verification\n\nOn an isolated test path, generate both directions of the intended exchange and inspect rule counters or captures. Try the intended denied traffic separately. Confirm that the selected interface carries Layer 2 headers and that portal behavior, if present, still follows the approved workflow.\n\n## Official reference\n\n[Netgate — Ethernet (Layer 2) Rules](https://docs.netgate.com/pfsense/en/latest/firewall/ethernet-rules.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/pair-pfsense-ethernet-rule-exceptions-in-both-directions-when-required/", "url": "https://update.dsesecurity.com/updates/pair-pfsense-ethernet-rule-exceptions-in-both-directions-when-required/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/pair-pfsense-ethernet-rule-exceptions-in-both-directions-when-required/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Pair pfSense Ethernet-rule exceptions in both directions when required", "item": "https://update.dsesecurity.com/updates/pair-pfsense-ethernet-rule-exceptions-in-both-directions-when-required/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/pair-pfsense-ethernet-rule-exceptions-in-both-directions-when-required/#article", "identifier": "https://update.dsesecurity.com/updates/pair-pfsense-ethernet-rule-exceptions-in-both-directions-when-required/", "url": "https://update.dsesecurity.com/updates/pair-pfsense-ethernet-rule-exceptions-in-both-directions-when-required/", "headline": "Pair pfSense Ethernet-rule exceptions in both directions when required", "description": "Layer 2 rules are stateless and cannot match on interfaces that do not carry Ethernet information.", "abstract": "Layer 2 rules are stateless and cannot match on interfaces that do not carry Ethernet information.", "articleBody": "Layer 2 rules are stateless and cannot match on interfaces that do not carry Ethernet information.\nSource facts\nNetgate documents Ethernet rules as stateless. An exception to a block may need inbound and outbound rules with reversed source and destination. The source warns that applying an Ethernet rule to a non-Layer-2 tunnel produces no error even though it cannot match. Manual Ethernet rules are evaluated before automatically managed captive-portal rules.\nSource: Netgate — Ethernet (Layer 2) Rules.\nApplicability\nThis concerns the documented pfSense Plus Ethernet-rule feature.\nDSE recommendation\nDSE recommends identifying the actual Ethernet boundary before using MAC or EtherType criteria. Describe the reverse direction explicitly and check whether an exception must cover it. Review any captive-portal interface for interference before enabling a broad manual rule. Avoid using a silent absence of errors as evidence that a rule is active. Keep a recovery connection available when changing Layer 2 admission because mistakes can affect supporting traffic as well as application packets. For every proposed exception, put the forward and reverse header criteria beside each other for review. Include one unsuitable interface as a design check, not an uncontrolled production experiment, and require a positive counter or capture before declaring a Layer 2 rule effective.\nVerification\nOn an isolated test path, generate both directions of the intended exchange and inspect rule counters or captures. Try the intended denied traffic separately. Confirm that the selected interface carries Layer 2 headers and that portal behavior, if present, still follows the approved workflow.\nOfficial reference\nNetgate — Ethernet (Layer 2) Rules. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:04+00:00", "dateModified": "2026-10-20T18:34:34+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/pair-pfsense-ethernet-rule-exceptions-in-both-directions-when-required/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/pair-pfsense-ethernet-rule-exceptions-in-both-directions-when-required/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Pair pfSense Ethernet-rule exceptions in both directions when required" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 251, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — Ethernet (Layer 2) Rules", "url": "https://docs.netgate.com/pfsense/en/latest/firewall/ethernet-rules.html" } } ] } }