{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/pfsense-multiwan-local-vpn-policy-route-bypass/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/pfsense-multiwan-local-vpn-policy-route-bypass/",
        "slug": "pfsense-multiwan-local-vpn-policy-route-bypass",
        "url": "https://update.dsesecurity.com/updates/pfsense-multiwan-local-vpn-policy-route-bypass/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/pfsense-multiwan-local-vpn-policy-route-bypass.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/pfsense-multiwan-local-vpn-policy-route-bypass/"
        },
        "title": "Keep local and VPN traffic above pfSense Multi-WAN policy-routing rules",
        "summary": "A gateway on a broad pass rule can send traffic away from routes that should remain local.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-15T13:33:36+00:00",
        "modified_at": "2026-10-15T13:36:17+00:00",
        "reviewed_on": "2026-10-15",
        "reading_minutes": 2,
        "word_count": 271,
        "potentially_affected": "This concerns pfSense Multi-WAN rules on the relevant ingress interface. The actual destinations and route exceptions must come from the approved network design rather than a copied example address list.",
        "dse_recommendation": "DSE recommends building an explicit exception list for internal services, remote VPN networks, and other destinations that should follow the routing table.",
        "primary_source": {
            "name": "Netgate — Policy routing",
            "url": "https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html",
            "published_on": null,
            "authority": "docs.netgate.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A gateway on a broad pass rule can send traffic away from routes that should remain local.</p>\n<h2>Source facts</h2>\n<p>In pfSense, selecting a gateway or gateway group on a firewall rule policy-routes matching traffic through that selection. Netgate states that traffic intended for other local interfaces, VPNs, MPLS, or normal routing-table decisions must bypass policy routing. The documented method places a matching rule without a selected gateway above the broader gateway-bearing rule. Rule order matters because the first match is used. Netgate also documents additional handling when traffic must stop rather than fall through to another route after a selected gateway fails.</p>\n<p>Source: <a href=\"https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html\">Netgate — Policy routing</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns pfSense Multi-WAN rules on the relevant ingress interface. The actual destinations and route exceptions must come from the approved network design rather than a copied example address list.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends building an explicit exception list for internal services, remote VPN networks, and other destinations that should follow the routing table. Review that list before changing a default pass rule to use a WAN group. Keep the exception rule immediately understandable and document why each destination belongs there. Decide separately which traffic may fail over and which must fail closed. Preserve the previous rule order for rollback, and coordinate testing with owners of remote management and site-to-site applications.</p>\n<h2>Verification</h2>\n<p>Test an approved local service, a VPN destination, and an internet destination from the same client. Confirm the intended path for each. During an authorized failure test, check both new connection behavior and the special cases that must stop instead of changing their exit path.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html\">Netgate — Policy routing</a>. Reviewed October 15, 2026.</p>",
        "content_text": "A gateway on a broad pass rule can send traffic away from routes that should remain local.\nSource facts\nIn pfSense, selecting a gateway or gateway group on a firewall rule policy-routes matching traffic through that selection. Netgate states that traffic intended for other local interfaces, VPNs, MPLS, or normal routing-table decisions must bypass policy routing. The documented method places a matching rule without a selected gateway above the broader gateway-bearing rule. Rule order matters because the first match is used. Netgate also documents additional handling when traffic must stop rather than fall through to another route after a selected gateway fails.\nSource: Netgate — Policy routing.\nApplicability\nThis concerns pfSense Multi-WAN rules on the relevant ingress interface. The actual destinations and route exceptions must come from the approved network design rather than a copied example address list.\nDSE recommendation\nDSE recommends building an explicit exception list for internal services, remote VPN networks, and other destinations that should follow the routing table. Review that list before changing a default pass rule to use a WAN group. Keep the exception rule immediately understandable and document why each destination belongs there. Decide separately which traffic may fail over and which must fail closed. Preserve the previous rule order for rollback, and coordinate testing with owners of remote management and site-to-site applications.\nVerification\nTest an approved local service, a VPN destination, and an internet destination from the same client. Confirm the intended path for each. During an authorized failure test, check both new connection behavior and the special cases that must stop instead of changing their exit path.\nOfficial reference\nNetgate — Policy routing. Reviewed October 15, 2026.",
        "content_markdown": "A gateway on a broad pass rule can send traffic away from routes that should remain local.\n\n## Source facts\n\nIn pfSense, selecting a gateway or gateway group on a firewall rule policy-routes matching traffic through that selection. Netgate states that traffic intended for other local interfaces, VPNs, MPLS, or normal routing-table decisions must bypass policy routing. The documented method places a matching rule without a selected gateway above the broader gateway-bearing rule. Rule order matters because the first match is used. Netgate also documents additional handling when traffic must stop rather than fall through to another route after a selected gateway fails.\n\nSource: [Netgate — Policy routing](https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html).\n\n## Applicability\n\nThis concerns pfSense Multi-WAN rules on the relevant ingress interface. The actual destinations and route exceptions must come from the approved network design rather than a copied example address list.\n\n## DSE recommendation\n\nDSE recommends building an explicit exception list for internal services, remote VPN networks, and other destinations that should follow the routing table. Review that list before changing a default pass rule to use a WAN group. Keep the exception rule immediately understandable and document why each destination belongs there. Decide separately which traffic may fail over and which must fail closed. Preserve the previous rule order for rollback, and coordinate testing with owners of remote management and site-to-site applications.\n\n## Verification\n\nTest an approved local service, a VPN destination, and an internet destination from the same client. Confirm the intended path for each. During an authorized failure test, check both new connection behavior and the special cases that must stop instead of changing their exit path.\n\n## Official reference\n\n[Netgate — Policy routing](https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html). Reviewed October 15, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/pfsense-multiwan-local-vpn-policy-route-bypass/",
                "url": "https://update.dsesecurity.com/updates/pfsense-multiwan-local-vpn-policy-route-bypass/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-15"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/pfsense-multiwan-local-vpn-policy-route-bypass/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Keep local and VPN traffic above pfSense Multi-WAN policy-routing rules",
                        "item": "https://update.dsesecurity.com/updates/pfsense-multiwan-local-vpn-policy-route-bypass/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/pfsense-multiwan-local-vpn-policy-route-bypass/#article",
                "identifier": "https://update.dsesecurity.com/updates/pfsense-multiwan-local-vpn-policy-route-bypass/",
                "url": "https://update.dsesecurity.com/updates/pfsense-multiwan-local-vpn-policy-route-bypass/",
                "headline": "Keep local and VPN traffic above pfSense Multi-WAN policy-routing rules",
                "description": "A gateway on a broad pass rule can send traffic away from routes that should remain local.",
                "abstract": "A gateway on a broad pass rule can send traffic away from routes that should remain local.",
                "articleBody": "A gateway on a broad pass rule can send traffic away from routes that should remain local.\nSource facts\nIn pfSense, selecting a gateway or gateway group on a firewall rule policy-routes matching traffic through that selection. Netgate states that traffic intended for other local interfaces, VPNs, MPLS, or normal routing-table decisions must bypass policy routing. The documented method places a matching rule without a selected gateway above the broader gateway-bearing rule. Rule order matters because the first match is used. Netgate also documents additional handling when traffic must stop rather than fall through to another route after a selected gateway fails.\nSource: Netgate — Policy routing.\nApplicability\nThis concerns pfSense Multi-WAN rules on the relevant ingress interface. The actual destinations and route exceptions must come from the approved network design rather than a copied example address list.\nDSE recommendation\nDSE recommends building an explicit exception list for internal services, remote VPN networks, and other destinations that should follow the routing table. Review that list before changing a default pass rule to use a WAN group. Keep the exception rule immediately understandable and document why each destination belongs there. Decide separately which traffic may fail over and which must fail closed. Preserve the previous rule order for rollback, and coordinate testing with owners of remote management and site-to-site applications.\nVerification\nTest an approved local service, a VPN destination, and an internet destination from the same client. Confirm the intended path for each. During an authorized failure test, check both new connection behavior and the special cases that must stop instead of changing their exit path.\nOfficial reference\nNetgate — Policy routing. Reviewed October 15, 2026.",
                "datePublished": "2026-10-15T13:33:36+00:00",
                "dateModified": "2026-10-15T13:36:17+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/pfsense-multiwan-local-vpn-policy-route-bypass/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/pfsense-multiwan-local-vpn-policy-route-bypass/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Keep local and VPN traffic above pfSense Multi-WAN policy-routing rules"
                },
                "articleSection": [
                    "IT",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "IT",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 271,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Netgate — Policy routing",
                    "url": "https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html"
                }
            }
        ]
    }
}