{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/review-every-pfsense-ipsec-tunnel-before-changing-the-global-filter-mode/", "item": { "id": "https://update.dsesecurity.com/updates/review-every-pfsense-ipsec-tunnel-before-changing-the-global-filter-mode/", "slug": "review-every-pfsense-ipsec-tunnel-before-changing-the-global-filter-mode", "url": "https://update.dsesecurity.com/updates/review-every-pfsense-ipsec-tunnel-before-changing-the-global-filter-mode/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/review-every-pfsense-ipsec-tunnel-before-changing-the-global-filter-mode.md", "json": "https://update.dsesecurity.com/api/v1/posts/review-every-pfsense-ipsec-tunnel-before-changing-the-global-filter-mode/" }, "title": "Review every pfSense IPsec tunnel before changing the global filter mode", "summary": "Enabling assigned-interface filtering can break tunnel-mode traffic elsewhere on the same firewall.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:06+00:00", "modified_at": "2026-10-20T18:34:34+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 253, "potentially_affected": "This concerns pfSense's IPsec Filter Mode and its firewall-wide compatibility consequence.", "dse_recommendation": "DSE recommends inventorying every IPsec phase-2 mode before changing the setting, including dormant partner and mobile configurations.", "primary_source": { "name": "Netgate — IPsec and firewall rules", "url": "https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/firewall-rules.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Enabling assigned-interface filtering can break tunnel-mode traffic elsewhere on the same firewall.

\n

Source facts

\n

Netgate documents a default IPsec-tab filter mode and an alternative that filters on assigned interfaces. The latter enables expected per-VTI rules, NAT, and reply-to handling for VTI or transport mode. Its stated downside is that all tunnel-mode traffic is dropped. The guide recommends that alternative when all tunnels use VTI or transport mode.

\n

Source: Netgate — IPsec and firewall rules.

\n

Applicability

\n

This concerns pfSense’s IPsec Filter Mode and its firewall-wide compatibility consequence.

\n

DSE recommendation

\n

DSE recommends inventorying every IPsec phase-2 mode before changing the setting, including dormant partner and mobile configurations. Treat conversion as an architectural change when tunnel-mode and VTI connections coexist. Document which rule tabs own inbound decrypted traffic and which local-interface tabs govern locally initiated traffic. Avoid enabling the alternative solely to solve one VTI NAT issue without an impact plan for unrelated tunnels. Make the complete tunnel inventory an approval prerequisite, with a mode and service owner for each entry. Ask owners of dormant partner tunnels to participate in the review. An improvement to one VTI path should not close the change while another tunnel mode remains incompatible.

\n

Verification

\n

In a lab matching the planned tunnel mix, test an allowed transaction through every mode before and after the proposed filter setting. Confirm the active rule tab, NAT requirement, and return path for VTI. Record any tunnel-mode incompatibility and resolve it in the design before production change approval.

\n

Official reference

\n

Netgate — IPsec and firewall rules. Reviewed October 20, 2026.

", "content_text": "Enabling assigned-interface filtering can break tunnel-mode traffic elsewhere on the same firewall.\nSource facts\nNetgate documents a default IPsec-tab filter mode and an alternative that filters on assigned interfaces. The latter enables expected per-VTI rules, NAT, and reply-to handling for VTI or transport mode. Its stated downside is that all tunnel-mode traffic is dropped. The guide recommends that alternative when all tunnels use VTI or transport mode.\nSource: Netgate — IPsec and firewall rules.\nApplicability\nThis concerns pfSense’s IPsec Filter Mode and its firewall-wide compatibility consequence.\nDSE recommendation\nDSE recommends inventorying every IPsec phase-2 mode before changing the setting, including dormant partner and mobile configurations. Treat conversion as an architectural change when tunnel-mode and VTI connections coexist. Document which rule tabs own inbound decrypted traffic and which local-interface tabs govern locally initiated traffic. Avoid enabling the alternative solely to solve one VTI NAT issue without an impact plan for unrelated tunnels. Make the complete tunnel inventory an approval prerequisite, with a mode and service owner for each entry. Ask owners of dormant partner tunnels to participate in the review. An improvement to one VTI path should not close the change while another tunnel mode remains incompatible.\nVerification\nIn a lab matching the planned tunnel mix, test an allowed transaction through every mode before and after the proposed filter setting. Confirm the active rule tab, NAT requirement, and return path for VTI. Record any tunnel-mode incompatibility and resolve it in the design before production change approval.\nOfficial reference\nNetgate — IPsec and firewall rules. Reviewed October 20, 2026.", "content_markdown": "Enabling assigned-interface filtering can break tunnel-mode traffic elsewhere on the same firewall.\n\n## Source facts\n\nNetgate documents a default IPsec-tab filter mode and an alternative that filters on assigned interfaces. The latter enables expected per-VTI rules, NAT, and reply-to handling for VTI or transport mode. Its stated downside is that all tunnel-mode traffic is dropped. The guide recommends that alternative when all tunnels use VTI or transport mode.\n\nSource: [Netgate — IPsec and firewall rules](https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/firewall-rules.html).\n\n## Applicability\n\nThis concerns pfSense’s IPsec Filter Mode and its firewall-wide compatibility consequence.\n\n## DSE recommendation\n\nDSE recommends inventorying every IPsec phase-2 mode before changing the setting, including dormant partner and mobile configurations. Treat conversion as an architectural change when tunnel-mode and VTI connections coexist. Document which rule tabs own inbound decrypted traffic and which local-interface tabs govern locally initiated traffic. Avoid enabling the alternative solely to solve one VTI NAT issue without an impact plan for unrelated tunnels. Make the complete tunnel inventory an approval prerequisite, with a mode and service owner for each entry. Ask owners of dormant partner tunnels to participate in the review. An improvement to one VTI path should not close the change while another tunnel mode remains incompatible.\n\n## Verification\n\nIn a lab matching the planned tunnel mix, test an allowed transaction through every mode before and after the proposed filter setting. Confirm the active rule tab, NAT requirement, and return path for VTI. Record any tunnel-mode incompatibility and resolve it in the design before production change approval.\n\n## Official reference\n\n[Netgate — IPsec and firewall rules](https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/firewall-rules.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/review-every-pfsense-ipsec-tunnel-before-changing-the-global-filter-mode/", "url": "https://update.dsesecurity.com/updates/review-every-pfsense-ipsec-tunnel-before-changing-the-global-filter-mode/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/review-every-pfsense-ipsec-tunnel-before-changing-the-global-filter-mode/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Review every pfSense IPsec tunnel before changing the global filter mode", "item": "https://update.dsesecurity.com/updates/review-every-pfsense-ipsec-tunnel-before-changing-the-global-filter-mode/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/review-every-pfsense-ipsec-tunnel-before-changing-the-global-filter-mode/#article", "identifier": "https://update.dsesecurity.com/updates/review-every-pfsense-ipsec-tunnel-before-changing-the-global-filter-mode/", "url": "https://update.dsesecurity.com/updates/review-every-pfsense-ipsec-tunnel-before-changing-the-global-filter-mode/", "headline": "Review every pfSense IPsec tunnel before changing the global filter mode", "description": "Enabling assigned-interface filtering can break tunnel-mode traffic elsewhere on the same firewall.", "abstract": "Enabling assigned-interface filtering can break tunnel-mode traffic elsewhere on the same firewall.", "articleBody": "Enabling assigned-interface filtering can break tunnel-mode traffic elsewhere on the same firewall.\nSource facts\nNetgate documents a default IPsec-tab filter mode and an alternative that filters on assigned interfaces. The latter enables expected per-VTI rules, NAT, and reply-to handling for VTI or transport mode. Its stated downside is that all tunnel-mode traffic is dropped. The guide recommends that alternative when all tunnels use VTI or transport mode.\nSource: Netgate — IPsec and firewall rules.\nApplicability\nThis concerns pfSense’s IPsec Filter Mode and its firewall-wide compatibility consequence.\nDSE recommendation\nDSE recommends inventorying every IPsec phase-2 mode before changing the setting, including dormant partner and mobile configurations. Treat conversion as an architectural change when tunnel-mode and VTI connections coexist. Document which rule tabs own inbound decrypted traffic and which local-interface tabs govern locally initiated traffic. Avoid enabling the alternative solely to solve one VTI NAT issue without an impact plan for unrelated tunnels. Make the complete tunnel inventory an approval prerequisite, with a mode and service owner for each entry. Ask owners of dormant partner tunnels to participate in the review. An improvement to one VTI path should not close the change while another tunnel mode remains incompatible.\nVerification\nIn a lab matching the planned tunnel mix, test an allowed transaction through every mode before and after the proposed filter setting. Confirm the active rule tab, NAT requirement, and return path for VTI. Record any tunnel-mode incompatibility and resolve it in the design before production change approval.\nOfficial reference\nNetgate — IPsec and firewall rules. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:06+00:00", "dateModified": "2026-10-20T18:34:34+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/review-every-pfsense-ipsec-tunnel-before-changing-the-global-filter-mode/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/review-every-pfsense-ipsec-tunnel-before-changing-the-global-filter-mode/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Review every pfSense IPsec tunnel before changing the global filter mode" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 253, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — IPsec and firewall rules", "url": "https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/firewall-rules.html" } } ] } }