{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/pin-the-pfsense-default-gateway-before-assigning-a-wireguard-interface/", "item": { "id": "https://update.dsesecurity.com/updates/pin-the-pfsense-default-gateway-before-assigning-a-wireguard-interface/", "slug": "pin-the-pfsense-default-gateway-before-assigning-a-wireguard-interface", "url": "https://update.dsesecurity.com/updates/pin-the-pfsense-default-gateway-before-assigning-a-wireguard-interface/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/pin-the-pfsense-default-gateway-before-assigning-a-wireguard-interface.md", "json": "https://update.dsesecurity.com/api/v1/posts/pin-the-pfsense-default-gateway-before-assigning-a-wireguard-interface/" }, "title": "Pin the pfSense default gateway before assigning a WireGuard interface", "summary": "Leaving Automatic selected can make the new tunnel an unintended default route.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:29+00:00", "modified_at": "2026-10-20T18:34:35+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 254, "potentially_affected": "This concerns pfSense WireGuard interface assignment.", "dse_recommendation": "DSE recommends capturing the current IPv4 and IPv6 default routes and deciding their intended values before adding the assigned tunnel.", "primary_source": { "name": "Netgate — Assign a WireGuard Interface", "url": "https://docs.netgate.com/pfsense/en/latest/vpn/wireguard/assign.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Leaving Automatic selected can make the new tunnel an unintended default route.

\n

Source facts

\n

Netgate’s assignment procedure instructs administrators to select a specific default gateway or group rather than Automatic. It warns that Automatic can select the WireGuard interface as default. Assignment creates a dedicated rule tab and enables interface selection for NAT and other features. The documented MTU must account for tunnel overhead on the actual underlying circuit.

\n

Source: Netgate — Assign a WireGuard Interface.

\n

Applicability

\n

This concerns pfSense WireGuard interface assignment.

\n

DSE recommendation

\n

DSE recommends capturing the current IPv4 and IPv6 default routes and deciding their intended values before adding the assigned tunnel. Keep a management path outside the tunnel during the change. Calculate an appropriate MTU from the real underlay rather than copying an Ethernet example onto a smaller circuit. Review NAT and interface rules after assignment because the new interface becomes selectable in additional places. Make the selected default gateway a pre-assignment checkpoint with an independent observer. After assignment, test a destination intended for the tunnel and an ordinary Internet destination. Preserve the route comparison with the interface record so a later reassignment can repeat the same check.

\n

Verification

\n

In an approved rehearsal, compare the default route before and after assignment and confirm ordinary Internet traffic still uses its intended path. Test the tunnel with representative packet sizes and a real application transaction. Verify that only approved destinations use the new interface and retain the route and MTU evidence with the configuration.

\n

Official reference

\n

Netgate — Assign a WireGuard Interface. Reviewed October 20, 2026.

", "content_text": "Leaving Automatic selected can make the new tunnel an unintended default route.\nSource facts\nNetgate’s assignment procedure instructs administrators to select a specific default gateway or group rather than Automatic. It warns that Automatic can select the WireGuard interface as default. Assignment creates a dedicated rule tab and enables interface selection for NAT and other features. The documented MTU must account for tunnel overhead on the actual underlying circuit.\nSource: Netgate — Assign a WireGuard Interface.\nApplicability\nThis concerns pfSense WireGuard interface assignment.\nDSE recommendation\nDSE recommends capturing the current IPv4 and IPv6 default routes and deciding their intended values before adding the assigned tunnel. Keep a management path outside the tunnel during the change. Calculate an appropriate MTU from the real underlay rather than copying an Ethernet example onto a smaller circuit. Review NAT and interface rules after assignment because the new interface becomes selectable in additional places. Make the selected default gateway a pre-assignment checkpoint with an independent observer. After assignment, test a destination intended for the tunnel and an ordinary Internet destination. Preserve the route comparison with the interface record so a later reassignment can repeat the same check.\nVerification\nIn an approved rehearsal, compare the default route before and after assignment and confirm ordinary Internet traffic still uses its intended path. Test the tunnel with representative packet sizes and a real application transaction. Verify that only approved destinations use the new interface and retain the route and MTU evidence with the configuration.\nOfficial reference\nNetgate — Assign a WireGuard Interface. Reviewed October 20, 2026.", "content_markdown": "Leaving Automatic selected can make the new tunnel an unintended default route.\n\n## Source facts\n\nNetgate’s assignment procedure instructs administrators to select a specific default gateway or group rather than Automatic. It warns that Automatic can select the WireGuard interface as default. Assignment creates a dedicated rule tab and enables interface selection for NAT and other features. The documented MTU must account for tunnel overhead on the actual underlying circuit.\n\nSource: [Netgate — Assign a WireGuard Interface](https://docs.netgate.com/pfsense/en/latest/vpn/wireguard/assign.html).\n\n## Applicability\n\nThis concerns pfSense WireGuard interface assignment.\n\n## DSE recommendation\n\nDSE recommends capturing the current IPv4 and IPv6 default routes and deciding their intended values before adding the assigned tunnel. Keep a management path outside the tunnel during the change. Calculate an appropriate MTU from the real underlay rather than copying an Ethernet example onto a smaller circuit. Review NAT and interface rules after assignment because the new interface becomes selectable in additional places. Make the selected default gateway a pre-assignment checkpoint with an independent observer. After assignment, test a destination intended for the tunnel and an ordinary Internet destination. Preserve the route comparison with the interface record so a later reassignment can repeat the same check.\n\n## Verification\n\nIn an approved rehearsal, compare the default route before and after assignment and confirm ordinary Internet traffic still uses its intended path. Test the tunnel with representative packet sizes and a real application transaction. Verify that only approved destinations use the new interface and retain the route and MTU evidence with the configuration.\n\n## Official reference\n\n[Netgate — Assign a WireGuard Interface](https://docs.netgate.com/pfsense/en/latest/vpn/wireguard/assign.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/pin-the-pfsense-default-gateway-before-assigning-a-wireguard-interface/", "url": "https://update.dsesecurity.com/updates/pin-the-pfsense-default-gateway-before-assigning-a-wireguard-interface/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/pin-the-pfsense-default-gateway-before-assigning-a-wireguard-interface/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Pin the pfSense default gateway before assigning a WireGuard interface", "item": "https://update.dsesecurity.com/updates/pin-the-pfsense-default-gateway-before-assigning-a-wireguard-interface/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/pin-the-pfsense-default-gateway-before-assigning-a-wireguard-interface/#article", "identifier": "https://update.dsesecurity.com/updates/pin-the-pfsense-default-gateway-before-assigning-a-wireguard-interface/", "url": "https://update.dsesecurity.com/updates/pin-the-pfsense-default-gateway-before-assigning-a-wireguard-interface/", "headline": "Pin the pfSense default gateway before assigning a WireGuard interface", "description": "Leaving Automatic selected can make the new tunnel an unintended default route.", "abstract": "Leaving Automatic selected can make the new tunnel an unintended default route.", "articleBody": "Leaving Automatic selected can make the new tunnel an unintended default route.\nSource facts\nNetgate’s assignment procedure instructs administrators to select a specific default gateway or group rather than Automatic. It warns that Automatic can select the WireGuard interface as default. Assignment creates a dedicated rule tab and enables interface selection for NAT and other features. The documented MTU must account for tunnel overhead on the actual underlying circuit.\nSource: Netgate — Assign a WireGuard Interface.\nApplicability\nThis concerns pfSense WireGuard interface assignment.\nDSE recommendation\nDSE recommends capturing the current IPv4 and IPv6 default routes and deciding their intended values before adding the assigned tunnel. Keep a management path outside the tunnel during the change. Calculate an appropriate MTU from the real underlay rather than copying an Ethernet example onto a smaller circuit. Review NAT and interface rules after assignment because the new interface becomes selectable in additional places. Make the selected default gateway a pre-assignment checkpoint with an independent observer. After assignment, test a destination intended for the tunnel and an ordinary Internet destination. Preserve the route comparison with the interface record so a later reassignment can repeat the same check.\nVerification\nIn an approved rehearsal, compare the default route before and after assignment and confirm ordinary Internet traffic still uses its intended path. Test the tunnel with representative packet sizes and a real application transaction. Verify that only approved destinations use the new interface and retain the route and MTU evidence with the configuration.\nOfficial reference\nNetgate — Assign a WireGuard Interface. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:29+00:00", "dateModified": "2026-10-20T18:34:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/pin-the-pfsense-default-gateway-before-assigning-a-wireguard-interface/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/pin-the-pfsense-default-gateway-before-assigning-a-wireguard-interface/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Pin the pfSense default gateway before assigning a WireGuard interface" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 254, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — Assign a WireGuard Interface", "url": "https://docs.netgate.com/pfsense/en/latest/vpn/wireguard/assign.html" } } ] } }