{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/review-every-permitted-protocol-when-using-pfsense-1-1-nat/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/review-every-permitted-protocol-when-using-pfsense-1-1-nat/",
        "slug": "review-every-permitted-protocol-when-using-pfsense-1-1-nat",
        "url": "https://update.dsesecurity.com/updates/review-every-permitted-protocol-when-using-pfsense-1-1-nat/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/review-every-permitted-protocol-when-using-pfsense-1-1-nat.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/review-every-permitted-protocol-when-using-pfsense-1-1-nat/"
        },
        "title": "Review every permitted protocol when using pfSense 1:1 NAT",
        "summary": "A broad WAN pass combined with 1:1 NAT exposes more than a single port forward would.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:15:57+00:00",
        "modified_at": "2026-10-20T18:34:34+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 234,
        "potentially_affected": "This concerns pfSense address mappings for a host or aligned equal-sized subnets.",
        "dse_recommendation": "DSE recommends creating an explicit service list before introducing a 1:1 mapping.",
        "primary_source": {
            "name": "Netgate — 1:1 NAT",
            "url": "https://docs.netgate.com/pfsense/en/latest/nat/1-1.html",
            "published_on": null,
            "authority": "docs.netgate.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A broad WAN pass combined with 1:1 NAT exposes more than a single port forward would.</p>\n<h2>Source facts</h2>\n<p>Netgate documents 1:1 NAT as an external-to-internal address mapping that preserves ports. Inbound packets are subsequently evaluated against firewall rules using the internal target. Unlike a single-port forward, a 1:1 mapping combined with an allow-all WAN rule can expose all services on the mapped host. Outbound 1:1 translation takes precedence over outbound NAT rules.</p>\n<p>Source: <a href=\"https://docs.netgate.com/pfsense/en/latest/nat/1-1.html\">Netgate — 1:1 NAT</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns pfSense address mappings for a host or aligned equal-sized subnets.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends creating an explicit service list before introducing a 1:1 mapping. Review the external-interface rules against the internal destination address and remove inherited broad permissions that are unnecessary. Include outbound identity in the change review because the same host may start presenting the mapped public address. Keep host-based access controls and maintenance responsibilities documented alongside the firewall configuration. Give the reviewer a protocol-by-protocol exposure table rather than an instruction to test the server. Include services that should remain private and the expected public identity for outbound traffic. Require an owner for every permitted entry before accepting the mapping.</p>\n<h2>Verification</h2>\n<p>From an approved external location, test the authorized services and representative denied ports. Inspect the translated inbound destination and outbound source independently. Confirm that a more specific port forward has not redirected one service to a different host than the general 1:1 mapping suggests.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.netgate.com/pfsense/en/latest/nat/1-1.html\">Netgate — 1:1 NAT</a>. Reviewed October 20, 2026.</p>",
        "content_text": "A broad WAN pass combined with 1:1 NAT exposes more than a single port forward would.\nSource facts\nNetgate documents 1:1 NAT as an external-to-internal address mapping that preserves ports. Inbound packets are subsequently evaluated against firewall rules using the internal target. Unlike a single-port forward, a 1:1 mapping combined with an allow-all WAN rule can expose all services on the mapped host. Outbound 1:1 translation takes precedence over outbound NAT rules.\nSource: Netgate — 1:1 NAT.\nApplicability\nThis concerns pfSense address mappings for a host or aligned equal-sized subnets.\nDSE recommendation\nDSE recommends creating an explicit service list before introducing a 1:1 mapping. Review the external-interface rules against the internal destination address and remove inherited broad permissions that are unnecessary. Include outbound identity in the change review because the same host may start presenting the mapped public address. Keep host-based access controls and maintenance responsibilities documented alongside the firewall configuration. Give the reviewer a protocol-by-protocol exposure table rather than an instruction to test the server. Include services that should remain private and the expected public identity for outbound traffic. Require an owner for every permitted entry before accepting the mapping.\nVerification\nFrom an approved external location, test the authorized services and representative denied ports. Inspect the translated inbound destination and outbound source independently. Confirm that a more specific port forward has not redirected one service to a different host than the general 1:1 mapping suggests.\nOfficial reference\nNetgate — 1:1 NAT. Reviewed October 20, 2026.",
        "content_markdown": "A broad WAN pass combined with 1:1 NAT exposes more than a single port forward would.\n\n## Source facts\n\nNetgate documents 1:1 NAT as an external-to-internal address mapping that preserves ports. Inbound packets are subsequently evaluated against firewall rules using the internal target. Unlike a single-port forward, a 1:1 mapping combined with an allow-all WAN rule can expose all services on the mapped host. Outbound 1:1 translation takes precedence over outbound NAT rules.\n\nSource: [Netgate — 1:1 NAT](https://docs.netgate.com/pfsense/en/latest/nat/1-1.html).\n\n## Applicability\n\nThis concerns pfSense address mappings for a host or aligned equal-sized subnets.\n\n## DSE recommendation\n\nDSE recommends creating an explicit service list before introducing a 1:1 mapping. Review the external-interface rules against the internal destination address and remove inherited broad permissions that are unnecessary. Include outbound identity in the change review because the same host may start presenting the mapped public address. Keep host-based access controls and maintenance responsibilities documented alongside the firewall configuration. Give the reviewer a protocol-by-protocol exposure table rather than an instruction to test the server. Include services that should remain private and the expected public identity for outbound traffic. Require an owner for every permitted entry before accepting the mapping.\n\n## Verification\n\nFrom an approved external location, test the authorized services and representative denied ports. Inspect the translated inbound destination and outbound source independently. Confirm that a more specific port forward has not redirected one service to a different host than the general 1:1 mapping suggests.\n\n## Official reference\n\n[Netgate — 1:1 NAT](https://docs.netgate.com/pfsense/en/latest/nat/1-1.html). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/review-every-permitted-protocol-when-using-pfsense-1-1-nat/",
                "url": "https://update.dsesecurity.com/updates/review-every-permitted-protocol-when-using-pfsense-1-1-nat/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/review-every-permitted-protocol-when-using-pfsense-1-1-nat/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Review every permitted protocol when using pfSense 1:1 NAT",
                        "item": "https://update.dsesecurity.com/updates/review-every-permitted-protocol-when-using-pfsense-1-1-nat/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/review-every-permitted-protocol-when-using-pfsense-1-1-nat/#article",
                "identifier": "https://update.dsesecurity.com/updates/review-every-permitted-protocol-when-using-pfsense-1-1-nat/",
                "url": "https://update.dsesecurity.com/updates/review-every-permitted-protocol-when-using-pfsense-1-1-nat/",
                "headline": "Review every permitted protocol when using pfSense 1:1 NAT",
                "description": "A broad WAN pass combined with 1:1 NAT exposes more than a single port forward would.",
                "abstract": "A broad WAN pass combined with 1:1 NAT exposes more than a single port forward would.",
                "articleBody": "A broad WAN pass combined with 1:1 NAT exposes more than a single port forward would.\nSource facts\nNetgate documents 1:1 NAT as an external-to-internal address mapping that preserves ports. Inbound packets are subsequently evaluated against firewall rules using the internal target. Unlike a single-port forward, a 1:1 mapping combined with an allow-all WAN rule can expose all services on the mapped host. Outbound 1:1 translation takes precedence over outbound NAT rules.\nSource: Netgate — 1:1 NAT.\nApplicability\nThis concerns pfSense address mappings for a host or aligned equal-sized subnets.\nDSE recommendation\nDSE recommends creating an explicit service list before introducing a 1:1 mapping. Review the external-interface rules against the internal destination address and remove inherited broad permissions that are unnecessary. Include outbound identity in the change review because the same host may start presenting the mapped public address. Keep host-based access controls and maintenance responsibilities documented alongside the firewall configuration. Give the reviewer a protocol-by-protocol exposure table rather than an instruction to test the server. Include services that should remain private and the expected public identity for outbound traffic. Require an owner for every permitted entry before accepting the mapping.\nVerification\nFrom an approved external location, test the authorized services and representative denied ports. Inspect the translated inbound destination and outbound source independently. Confirm that a more specific port forward has not redirected one service to a different host than the general 1:1 mapping suggests.\nOfficial reference\nNetgate — 1:1 NAT. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:15:57+00:00",
                "dateModified": "2026-10-20T18:34:34+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/review-every-permitted-protocol-when-using-pfsense-1-1-nat/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/review-every-permitted-protocol-when-using-pfsense-1-1-nat/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Review every permitted protocol when using pfSense 1:1 NAT"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 234,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Netgate — 1:1 NAT",
                    "url": "https://docs.netgate.com/pfsense/en/latest/nat/1-1.html"
                }
            }
        ]
    }
}