{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/pfsense-internal-service-split-dns-port-check/", "item": { "id": "https://update.dsesecurity.com/updates/pfsense-internal-service-split-dns-port-check/", "slug": "pfsense-internal-service-split-dns-port-check", "url": "https://update.dsesecurity.com/updates/pfsense-internal-service-split-dns-port-check/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/pfsense-internal-service-split-dns-port-check.md", "json": "https://update.dsesecurity.com/api/v1/posts/pfsense-internal-service-split-dns-port-check/" }, "title": "Check split DNS before adding pfSense NAT reflection", "summary": "Check internal name resolution and port consistency when a public service name fails from inside the LAN.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-15T00:43:26+00:00", "modified_at": "2026-10-15T00:44:33+00:00", "reviewed_on": "2026-10-14", "reading_minutes": 2, "word_count": 242, "potentially_affected": "Use this for services hosted behind pfSense when internal and external access behave differently. Verify the actual DNS infrastructure and port-forward design before selecting the remedy.", "dse_recommendation": "DSE recommends collecting the hostname, internal and external resolved addresses, public port, server port, and certificate name before changing firewall settings.", "primary_source": { "name": "Netgate — pfSense NAT Reflection", "url": "https://docs.netgate.com/pfsense/en/latest/nat/reflection.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Check internal name resolution and port consistency when a public service name fails from inside the LAN.

\n

Source facts

\n

Netgate recommends split DNS as an alternative to NAT reflection for local access to local services. The same hostname resolves to a public address outside and a private address inside. Internal clients can then reach the local server directly. The guide highlights an important limit: the internal and external service port must be the same for this approach. Certain reflection arrangements also mask the original client address.

\n

Source: Netgate — pfSense NAT Reflection.

\n

Applicability

\n

Use this for services hosted behind pfSense when internal and external access behave differently. Verify the actual DNS infrastructure and port-forward design before selecting the remedy.

\n

DSE recommendation

\n

DSE recommends collecting the hostname, internal and external resolved addresses, public port, server port, and certificate name before changing firewall settings. Compare a LAN client and a genuinely external client. If split DNS fits the port design, coordinate the needed records with the DNS owner and preserve unrelated records. If translated ports prevent that approach, review the documented reflection mode and logging implications instead of applying a global option without an acceptance plan.

\n

Verification

\n

Verify DNS answers from both locations and complete the intended application transaction using the service hostname. Confirm certificate validation and the client address visible to the application. Record the selected design and retest from representative internal networks after the change.

\n

Official reference

\n

Netgate — pfSense NAT Reflection. Reviewed October 14, 2026.

", "content_text": "Check internal name resolution and port consistency when a public service name fails from inside the LAN.\nSource facts\nNetgate recommends split DNS as an alternative to NAT reflection for local access to local services. The same hostname resolves to a public address outside and a private address inside. Internal clients can then reach the local server directly. The guide highlights an important limit: the internal and external service port must be the same for this approach. Certain reflection arrangements also mask the original client address.\nSource: Netgate — pfSense NAT Reflection.\nApplicability\nUse this for services hosted behind pfSense when internal and external access behave differently. Verify the actual DNS infrastructure and port-forward design before selecting the remedy.\nDSE recommendation\nDSE recommends collecting the hostname, internal and external resolved addresses, public port, server port, and certificate name before changing firewall settings. Compare a LAN client and a genuinely external client. If split DNS fits the port design, coordinate the needed records with the DNS owner and preserve unrelated records. If translated ports prevent that approach, review the documented reflection mode and logging implications instead of applying a global option without an acceptance plan.\nVerification\nVerify DNS answers from both locations and complete the intended application transaction using the service hostname. Confirm certificate validation and the client address visible to the application. Record the selected design and retest from representative internal networks after the change.\nOfficial reference\nNetgate — pfSense NAT Reflection. Reviewed October 14, 2026.", "content_markdown": "Check internal name resolution and port consistency when a public service name fails from inside the LAN.\n\n## Source facts\n\nNetgate recommends split DNS as an alternative to NAT reflection for local access to local services. The same hostname resolves to a public address outside and a private address inside. Internal clients can then reach the local server directly. The guide highlights an important limit: the internal and external service port must be the same for this approach. Certain reflection arrangements also mask the original client address.\n\nSource: [Netgate — pfSense NAT Reflection](https://docs.netgate.com/pfsense/en/latest/nat/reflection.html).\n\n## Applicability\n\nUse this for services hosted behind pfSense when internal and external access behave differently. Verify the actual DNS infrastructure and port-forward design before selecting the remedy.\n\n## DSE recommendation\n\nDSE recommends collecting the hostname, internal and external resolved addresses, public port, server port, and certificate name before changing firewall settings. Compare a LAN client and a genuinely external client. If split DNS fits the port design, coordinate the needed records with the DNS owner and preserve unrelated records. If translated ports prevent that approach, review the documented reflection mode and logging implications instead of applying a global option without an acceptance plan.\n\n## Verification\n\nVerify DNS answers from both locations and complete the intended application transaction using the service hostname. Confirm certificate validation and the client address visible to the application. Record the selected design and retest from representative internal networks after the change.\n\n## Official reference\n\n[Netgate — pfSense NAT Reflection](https://docs.netgate.com/pfsense/en/latest/nat/reflection.html). Reviewed October 14, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/pfsense-internal-service-split-dns-port-check/", "url": "https://update.dsesecurity.com/updates/pfsense-internal-service-split-dns-port-check/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-14" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/pfsense-internal-service-split-dns-port-check/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check split DNS before adding pfSense NAT reflection", "item": "https://update.dsesecurity.com/updates/pfsense-internal-service-split-dns-port-check/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/pfsense-internal-service-split-dns-port-check/#article", "identifier": "https://update.dsesecurity.com/updates/pfsense-internal-service-split-dns-port-check/", "url": "https://update.dsesecurity.com/updates/pfsense-internal-service-split-dns-port-check/", "headline": "Check split DNS before adding pfSense NAT reflection", "description": "Check internal name resolution and port consistency when a public service name fails from inside the LAN.", "abstract": "Check internal name resolution and port consistency when a public service name fails from inside the LAN.", "articleBody": "Check internal name resolution and port consistency when a public service name fails from inside the LAN.\nSource facts\nNetgate recommends split DNS as an alternative to NAT reflection for local access to local services. The same hostname resolves to a public address outside and a private address inside. Internal clients can then reach the local server directly. The guide highlights an important limit: the internal and external service port must be the same for this approach. Certain reflection arrangements also mask the original client address.\nSource: Netgate — pfSense NAT Reflection.\nApplicability\nUse this for services hosted behind pfSense when internal and external access behave differently. Verify the actual DNS infrastructure and port-forward design before selecting the remedy.\nDSE recommendation\nDSE recommends collecting the hostname, internal and external resolved addresses, public port, server port, and certificate name before changing firewall settings. Compare a LAN client and a genuinely external client. If split DNS fits the port design, coordinate the needed records with the DNS owner and preserve unrelated records. If translated ports prevent that approach, review the documented reflection mode and logging implications instead of applying a global option without an acceptance plan.\nVerification\nVerify DNS answers from both locations and complete the intended application transaction using the service hostname. Confirm certificate validation and the client address visible to the application. Record the selected design and retest from representative internal networks after the change.\nOfficial reference\nNetgate — pfSense NAT Reflection. Reviewed October 14, 2026.", "datePublished": "2026-10-15T00:43:26+00:00", "dateModified": "2026-10-15T00:44:33+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/pfsense-internal-service-split-dns-port-check/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/pfsense-internal-service-split-dns-port-check/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check split DNS before adding pfSense NAT reflection" }, "articleSection": [ "Networks & Infrastructure" ], "keywords": [ "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 242, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — pfSense NAT Reflection", "url": "https://docs.netgate.com/pfsense/en/latest/nat/reflection.html" } } ] } }