{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/pfsense-gateway-monitor-target-failure-scope/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/pfsense-gateway-monitor-target-failure-scope/",
        "slug": "pfsense-gateway-monitor-target-failure-scope",
        "url": "https://update.dsesecurity.com/updates/pfsense-gateway-monitor-target-failure-scope/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/pfsense-gateway-monitor-target-failure-scope.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/pfsense-gateway-monitor-target-failure-scope/"
        },
        "title": "Choose what a pfSense gateway monitor actually proves",
        "summary": "A responding local modem and a usable upstream internet path are different observations.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-15T13:33:37+00:00",
        "modified_at": "2026-10-15T13:36:17+00:00",
        "reviewed_on": "2026-10-15",
        "reading_minutes": 2,
        "word_count": 267,
        "potentially_affected": "This applies to pfSense gateway monitoring and Multi-WAN decisions. A successful probe to one address does not demonstrate that every DNS service, application, or destination is healthy.",
        "dse_recommendation": "DSE recommends choosing a stable permitted target whose location matches the failure boundary the WAN policy needs to detect.",
        "primary_source": {
            "name": "Netgate — Gateway settings",
            "url": "https://docs.netgate.com/pfsense/en/latest/routing/gateway-configure.html",
            "published_on": null,
            "authority": "docs.netgate.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A responding local modem and a usable upstream internet path are different observations.</p>\n<h2>Source facts</h2>\n<p>pfSense gateway monitoring uses ICMP probes to a configured Monitor IP and reports latency and packet loss for that target. By default, the target is the gateway address, which may be a local modem or provider device. Netgate explains that an upstream target can better reveal failures beyond that first hop. Each gateway must use a unique monitor address, and pfSense normally adds a route to send probes through the expected gateway. Disabling monitoring differs from disabling actions triggered by monitoring changes.</p>\n<p>Source: <a href=\"https://docs.netgate.com/pfsense/en/latest/routing/gateway-configure.html\">Netgate — Gateway settings</a>.</p>\n<h2>Applicability</h2>\n<p>This applies to pfSense gateway monitoring and Multi-WAN decisions. A successful probe to one address does not demonstrate that every DNS service, application, or destination is healthy.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends choosing a stable permitted target whose location matches the failure boundary the WAN policy needs to detect. Document why the target was selected and which services it cannot validate. Review generated monitor routes so a probe cannot succeed through the wrong exit. Decide deliberately whether monitoring should trigger failover or only provide observations. Avoid masking a real upstream issue by simply disabling monitoring, and use separate application checks when the requirement is more specific than general path reachability.</p>\n<h2>Verification</h2>\n<p>Confirm the monitor target and route for each gateway, then compare gateway status with an approved application test. During a controlled failure, verify the expected monitoring action and recovery behavior. Keep latency and loss evidence tied to the chosen target rather than describing it as universal internet availability.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.netgate.com/pfsense/en/latest/routing/gateway-configure.html\">Netgate — Gateway settings</a>. Reviewed October 15, 2026.</p>",
        "content_text": "A responding local modem and a usable upstream internet path are different observations.\nSource facts\npfSense gateway monitoring uses ICMP probes to a configured Monitor IP and reports latency and packet loss for that target. By default, the target is the gateway address, which may be a local modem or provider device. Netgate explains that an upstream target can better reveal failures beyond that first hop. Each gateway must use a unique monitor address, and pfSense normally adds a route to send probes through the expected gateway. Disabling monitoring differs from disabling actions triggered by monitoring changes.\nSource: Netgate — Gateway settings.\nApplicability\nThis applies to pfSense gateway monitoring and Multi-WAN decisions. A successful probe to one address does not demonstrate that every DNS service, application, or destination is healthy.\nDSE recommendation\nDSE recommends choosing a stable permitted target whose location matches the failure boundary the WAN policy needs to detect. Document why the target was selected and which services it cannot validate. Review generated monitor routes so a probe cannot succeed through the wrong exit. Decide deliberately whether monitoring should trigger failover or only provide observations. Avoid masking a real upstream issue by simply disabling monitoring, and use separate application checks when the requirement is more specific than general path reachability.\nVerification\nConfirm the monitor target and route for each gateway, then compare gateway status with an approved application test. During a controlled failure, verify the expected monitoring action and recovery behavior. Keep latency and loss evidence tied to the chosen target rather than describing it as universal internet availability.\nOfficial reference\nNetgate — Gateway settings. Reviewed October 15, 2026.",
        "content_markdown": "A responding local modem and a usable upstream internet path are different observations.\n\n## Source facts\n\npfSense gateway monitoring uses ICMP probes to a configured Monitor IP and reports latency and packet loss for that target. By default, the target is the gateway address, which may be a local modem or provider device. Netgate explains that an upstream target can better reveal failures beyond that first hop. Each gateway must use a unique monitor address, and pfSense normally adds a route to send probes through the expected gateway. Disabling monitoring differs from disabling actions triggered by monitoring changes.\n\nSource: [Netgate — Gateway settings](https://docs.netgate.com/pfsense/en/latest/routing/gateway-configure.html).\n\n## Applicability\n\nThis applies to pfSense gateway monitoring and Multi-WAN decisions. A successful probe to one address does not demonstrate that every DNS service, application, or destination is healthy.\n\n## DSE recommendation\n\nDSE recommends choosing a stable permitted target whose location matches the failure boundary the WAN policy needs to detect. Document why the target was selected and which services it cannot validate. Review generated monitor routes so a probe cannot succeed through the wrong exit. Decide deliberately whether monitoring should trigger failover or only provide observations. Avoid masking a real upstream issue by simply disabling monitoring, and use separate application checks when the requirement is more specific than general path reachability.\n\n## Verification\n\nConfirm the monitor target and route for each gateway, then compare gateway status with an approved application test. During a controlled failure, verify the expected monitoring action and recovery behavior. Keep latency and loss evidence tied to the chosen target rather than describing it as universal internet availability.\n\n## Official reference\n\n[Netgate — Gateway settings](https://docs.netgate.com/pfsense/en/latest/routing/gateway-configure.html). Reviewed October 15, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/pfsense-gateway-monitor-target-failure-scope/",
                "url": "https://update.dsesecurity.com/updates/pfsense-gateway-monitor-target-failure-scope/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-15"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/pfsense-gateway-monitor-target-failure-scope/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Choose what a pfSense gateway monitor actually proves",
                        "item": "https://update.dsesecurity.com/updates/pfsense-gateway-monitor-target-failure-scope/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/pfsense-gateway-monitor-target-failure-scope/#article",
                "identifier": "https://update.dsesecurity.com/updates/pfsense-gateway-monitor-target-failure-scope/",
                "url": "https://update.dsesecurity.com/updates/pfsense-gateway-monitor-target-failure-scope/",
                "headline": "Choose what a pfSense gateway monitor actually proves",
                "description": "A responding local modem and a usable upstream internet path are different observations.",
                "abstract": "A responding local modem and a usable upstream internet path are different observations.",
                "articleBody": "A responding local modem and a usable upstream internet path are different observations.\nSource facts\npfSense gateway monitoring uses ICMP probes to a configured Monitor IP and reports latency and packet loss for that target. By default, the target is the gateway address, which may be a local modem or provider device. Netgate explains that an upstream target can better reveal failures beyond that first hop. Each gateway must use a unique monitor address, and pfSense normally adds a route to send probes through the expected gateway. Disabling monitoring differs from disabling actions triggered by monitoring changes.\nSource: Netgate — Gateway settings.\nApplicability\nThis applies to pfSense gateway monitoring and Multi-WAN decisions. A successful probe to one address does not demonstrate that every DNS service, application, or destination is healthy.\nDSE recommendation\nDSE recommends choosing a stable permitted target whose location matches the failure boundary the WAN policy needs to detect. Document why the target was selected and which services it cannot validate. Review generated monitor routes so a probe cannot succeed through the wrong exit. Decide deliberately whether monitoring should trigger failover or only provide observations. Avoid masking a real upstream issue by simply disabling monitoring, and use separate application checks when the requirement is more specific than general path reachability.\nVerification\nConfirm the monitor target and route for each gateway, then compare gateway status with an approved application test. During a controlled failure, verify the expected monitoring action and recovery behavior. Keep latency and loss evidence tied to the chosen target rather than describing it as universal internet availability.\nOfficial reference\nNetgate — Gateway settings. Reviewed October 15, 2026.",
                "datePublished": "2026-10-15T13:33:37+00:00",
                "dateModified": "2026-10-15T13:36:17+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/pfsense-gateway-monitor-target-failure-scope/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/pfsense-gateway-monitor-target-failure-scope/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Choose what a pfSense gateway monitor actually proves"
                },
                "articleSection": [
                    "Business Continuity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Business Continuity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 267,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Netgate — Gateway settings",
                    "url": "https://docs.netgate.com/pfsense/en/latest/routing/gateway-configure.html"
                }
            }
        ]
    }
}