{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/route-firewall-originated-pfsense-services-separately-from-client-policy-rules/", "item": { "id": "https://update.dsesecurity.com/updates/route-firewall-originated-pfsense-services-separately-from-client-policy-rules/", "slug": "route-firewall-originated-pfsense-services-separately-from-client-policy-rules", "url": "https://update.dsesecurity.com/updates/route-firewall-originated-pfsense-services-separately-from-client-policy-rules/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/route-firewall-originated-pfsense-services-separately-from-client-policy-rules.md", "json": "https://update.dsesecurity.com/api/v1/posts/route-firewall-originated-pfsense-services-separately-from-client-policy-rules/" }, "title": "Route firewall-originated pfSense services separately from client policy rules", "summary": "A working client failover rule does not establish the path used by the firewall's own daemons.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:03+00:00", "modified_at": "2026-10-20T18:34:34+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 249, "potentially_affected": "This concerns pfSense-originated traffic such as DNS or service connections.", "dse_recommendation": "DSE recommends listing the firewall's own external dependencies alongside the client traffic matrix.", "primary_source": { "name": "Netgate — Multi-WAN Caveats and Considerations", "url": "https://docs.netgate.com/pfsense/en/latest/multiwan/considerations.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A working client failover rule does not establish the path used by the firewall’s own daemons.

\n

Source facts

\n

Netgate states that traffic initiated by the firewall itself follows its routing table, rather than policy-routing rules on internal interfaces. Services bound to non-default WANs can have additional state-policy considerations. The documentation recommends reviewing default-gateway switching and, where needed, static routes for local services in a Multi-WAN design.

\n

Source: Netgate — Multi-WAN Caveats and Considerations.

\n

Applicability

\n

This concerns pfSense-originated traffic such as DNS or service connections.

\n

DSE recommendation

\n

DSE recommends listing the firewall’s own external dependencies alongside the client traffic matrix. For each service, record the listener or source binding, destination, expected route, and behavior when the preferred circuit fails. Include DNS, monitoring, updates, and VPN initiation where present. Do not assume a successful workstation test proves those local dependencies survived the same event. Keep route exceptions narrowly tied to the actual service requirement. Assign a distinct acceptance result to each firewall-originated dependency. Ask the owner to nominate one request made by the firewall and one made by a workstation, then preserve both outcomes for the same outage interval rather than inferring one from the other.

\n

Verification

\n

During an approved failover rehearsal, test the required service from the firewall context and compare it with a client-generated request. Inspect the routing table and chosen source address. Repeat on restoration and note whether a daemon needs a supported reconnection action before declaring local-service recovery complete.

\n

Official reference

\n

Netgate — Multi-WAN Caveats and Considerations. Reviewed October 20, 2026.

", "content_text": "A working client failover rule does not establish the path used by the firewall’s own daemons.\nSource facts\nNetgate states that traffic initiated by the firewall itself follows its routing table, rather than policy-routing rules on internal interfaces. Services bound to non-default WANs can have additional state-policy considerations. The documentation recommends reviewing default-gateway switching and, where needed, static routes for local services in a Multi-WAN design.\nSource: Netgate — Multi-WAN Caveats and Considerations.\nApplicability\nThis concerns pfSense-originated traffic such as DNS or service connections.\nDSE recommendation\nDSE recommends listing the firewall’s own external dependencies alongside the client traffic matrix. For each service, record the listener or source binding, destination, expected route, and behavior when the preferred circuit fails. Include DNS, monitoring, updates, and VPN initiation where present. Do not assume a successful workstation test proves those local dependencies survived the same event. Keep route exceptions narrowly tied to the actual service requirement. Assign a distinct acceptance result to each firewall-originated dependency. Ask the owner to nominate one request made by the firewall and one made by a workstation, then preserve both outcomes for the same outage interval rather than inferring one from the other.\nVerification\nDuring an approved failover rehearsal, test the required service from the firewall context and compare it with a client-generated request. Inspect the routing table and chosen source address. Repeat on restoration and note whether a daemon needs a supported reconnection action before declaring local-service recovery complete.\nOfficial reference\nNetgate — Multi-WAN Caveats and Considerations. Reviewed October 20, 2026.", "content_markdown": "A working client failover rule does not establish the path used by the firewall’s own daemons.\n\n## Source facts\n\nNetgate states that traffic initiated by the firewall itself follows its routing table, rather than policy-routing rules on internal interfaces. Services bound to non-default WANs can have additional state-policy considerations. The documentation recommends reviewing default-gateway switching and, where needed, static routes for local services in a Multi-WAN design.\n\nSource: [Netgate — Multi-WAN Caveats and Considerations](https://docs.netgate.com/pfsense/en/latest/multiwan/considerations.html).\n\n## Applicability\n\nThis concerns pfSense-originated traffic such as DNS or service connections.\n\n## DSE recommendation\n\nDSE recommends listing the firewall’s own external dependencies alongside the client traffic matrix. For each service, record the listener or source binding, destination, expected route, and behavior when the preferred circuit fails. Include DNS, monitoring, updates, and VPN initiation where present. Do not assume a successful workstation test proves those local dependencies survived the same event. Keep route exceptions narrowly tied to the actual service requirement. Assign a distinct acceptance result to each firewall-originated dependency. Ask the owner to nominate one request made by the firewall and one made by a workstation, then preserve both outcomes for the same outage interval rather than inferring one from the other.\n\n## Verification\n\nDuring an approved failover rehearsal, test the required service from the firewall context and compare it with a client-generated request. Inspect the routing table and chosen source address. Repeat on restoration and note whether a daemon needs a supported reconnection action before declaring local-service recovery complete.\n\n## Official reference\n\n[Netgate — Multi-WAN Caveats and Considerations](https://docs.netgate.com/pfsense/en/latest/multiwan/considerations.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/route-firewall-originated-pfsense-services-separately-from-client-policy-rules/", "url": "https://update.dsesecurity.com/updates/route-firewall-originated-pfsense-services-separately-from-client-policy-rules/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/route-firewall-originated-pfsense-services-separately-from-client-policy-rules/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Route firewall-originated pfSense services separately from client policy rules", "item": "https://update.dsesecurity.com/updates/route-firewall-originated-pfsense-services-separately-from-client-policy-rules/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/route-firewall-originated-pfsense-services-separately-from-client-policy-rules/#article", "identifier": "https://update.dsesecurity.com/updates/route-firewall-originated-pfsense-services-separately-from-client-policy-rules/", "url": "https://update.dsesecurity.com/updates/route-firewall-originated-pfsense-services-separately-from-client-policy-rules/", "headline": "Route firewall-originated pfSense services separately from client policy rules", "description": "A working client failover rule does not establish the path used by the firewall's own daemons.", "abstract": "A working client failover rule does not establish the path used by the firewall's own daemons.", "articleBody": "A working client failover rule does not establish the path used by the firewall’s own daemons.\nSource facts\nNetgate states that traffic initiated by the firewall itself follows its routing table, rather than policy-routing rules on internal interfaces. Services bound to non-default WANs can have additional state-policy considerations. The documentation recommends reviewing default-gateway switching and, where needed, static routes for local services in a Multi-WAN design.\nSource: Netgate — Multi-WAN Caveats and Considerations.\nApplicability\nThis concerns pfSense-originated traffic such as DNS or service connections.\nDSE recommendation\nDSE recommends listing the firewall’s own external dependencies alongside the client traffic matrix. For each service, record the listener or source binding, destination, expected route, and behavior when the preferred circuit fails. Include DNS, monitoring, updates, and VPN initiation where present. Do not assume a successful workstation test proves those local dependencies survived the same event. Keep route exceptions narrowly tied to the actual service requirement. Assign a distinct acceptance result to each firewall-originated dependency. Ask the owner to nominate one request made by the firewall and one made by a workstation, then preserve both outcomes for the same outage interval rather than inferring one from the other.\nVerification\nDuring an approved failover rehearsal, test the required service from the firewall context and compare it with a client-generated request. Inspect the routing table and chosen source address. Repeat on restoration and note whether a daemon needs a supported reconnection action before declaring local-service recovery complete.\nOfficial reference\nNetgate — Multi-WAN Caveats and Considerations. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:03+00:00", "dateModified": "2026-10-20T18:34:34+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/route-firewall-originated-pfsense-services-separately-from-client-policy-rules/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/route-firewall-originated-pfsense-services-separately-from-client-policy-rules/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Route firewall-originated pfSense services separately from client policy rules" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 249, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — Multi-WAN Caveats and Considerations", "url": "https://docs.netgate.com/pfsense/en/latest/multiwan/considerations.html" } } ] } }