{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/test-pfsense-wireguard-carp-maintenance-separately-from-a-powered-off-node/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/test-pfsense-wireguard-carp-maintenance-separately-from-a-powered-off-node/",
        "slug": "test-pfsense-wireguard-carp-maintenance-separately-from-a-powered-off-node",
        "url": "https://update.dsesecurity.com/updates/test-pfsense-wireguard-carp-maintenance-separately-from-a-powered-off-node/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/test-pfsense-wireguard-carp-maintenance-separately-from-a-powered-off-node.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/test-pfsense-wireguard-carp-maintenance-separately-from-a-powered-off-node/"
        },
        "title": "Test pfSense WireGuard CARP maintenance separately from a powered-off node",
        "summary": "A live former master can respond from a different address and influence the remote peer's endpoint.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:16:28+00:00",
        "modified_at": "2026-10-20T18:34:35+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 257,
        "potentially_affected": "This concerns the documented FreeBSD/pfSense WireGuard implementation with HA addressing.",
        "dse_recommendation": "DSE recommends recording the intended public endpoint and initiation direction alongside CARP ownership.",
        "primary_source": {
            "name": "Netgate — WireGuard Limitations",
            "url": "https://docs.netgate.com/pfsense/en/latest/vpn/wireguard/limitations.html",
            "published_on": null,
            "authority": "docs.netgate.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A live former master can respond from a different address and influence the remote peer&#8217;s endpoint.</p>\n<h2>Source facts</h2>\n<p>Netgate warns that WireGuard address selection can behave unexpectedly with CARP. A node entering maintenance can stop owning the VIP yet continue replying from its interface address, causing the remote peer to keep contacting that node. Power-off and reboot differ because that node cannot send the unexpected reply. Letting the remote peer always initiate can work around documented initiation-source limitations.</p>\n<p>Source: <a href=\"https://docs.netgate.com/pfsense/en/latest/vpn/wireguard/limitations.html\">Netgate — WireGuard Limitations</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns the documented FreeBSD/pfSense WireGuard implementation with HA addressing.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends recording the intended public endpoint and initiation direction alongside CARP ownership. Include planned maintenance, hard node loss, and restoration as separate acceptance scenarios. Avoid assuming an outbound NAT workaround makes initiation from a CARP VIP transferable between nodes; the source documents a state-ownership limitation. Coordinate tests with the remote VPN owner so endpoint changes can be observed rather than guessed from a local status indicator. Name maintenance, reboot, and power loss as separate HA acceptance cases. Retain the remote peer&#8217;s observed endpoint for each transition and compare it with the intended VIP. Do not use a successful power-off result to close an untested live-maintenance case.</p>\n<h2>Verification</h2>\n<p>Using an approved nonproduction peer, compare a CARP maintenance transition with a node shutdown. Inspect the observed source address and the peer&#8217;s learned endpoint after each event. Confirm which node carries application traffic and repeat restoration before declaring the design suitable for the required maintenance procedure.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.netgate.com/pfsense/en/latest/vpn/wireguard/limitations.html\">Netgate — WireGuard Limitations</a>. Reviewed October 20, 2026.</p>",
        "content_text": "A live former master can respond from a different address and influence the remote peer’s endpoint.\nSource facts\nNetgate warns that WireGuard address selection can behave unexpectedly with CARP. A node entering maintenance can stop owning the VIP yet continue replying from its interface address, causing the remote peer to keep contacting that node. Power-off and reboot differ because that node cannot send the unexpected reply. Letting the remote peer always initiate can work around documented initiation-source limitations.\nSource: Netgate — WireGuard Limitations.\nApplicability\nThis concerns the documented FreeBSD/pfSense WireGuard implementation with HA addressing.\nDSE recommendation\nDSE recommends recording the intended public endpoint and initiation direction alongside CARP ownership. Include planned maintenance, hard node loss, and restoration as separate acceptance scenarios. Avoid assuming an outbound NAT workaround makes initiation from a CARP VIP transferable between nodes; the source documents a state-ownership limitation. Coordinate tests with the remote VPN owner so endpoint changes can be observed rather than guessed from a local status indicator. Name maintenance, reboot, and power loss as separate HA acceptance cases. Retain the remote peer’s observed endpoint for each transition and compare it with the intended VIP. Do not use a successful power-off result to close an untested live-maintenance case.\nVerification\nUsing an approved nonproduction peer, compare a CARP maintenance transition with a node shutdown. Inspect the observed source address and the peer’s learned endpoint after each event. Confirm which node carries application traffic and repeat restoration before declaring the design suitable for the required maintenance procedure.\nOfficial reference\nNetgate — WireGuard Limitations. Reviewed October 20, 2026.",
        "content_markdown": "A live former master can respond from a different address and influence the remote peer’s endpoint.\n\n## Source facts\n\nNetgate warns that WireGuard address selection can behave unexpectedly with CARP. A node entering maintenance can stop owning the VIP yet continue replying from its interface address, causing the remote peer to keep contacting that node. Power-off and reboot differ because that node cannot send the unexpected reply. Letting the remote peer always initiate can work around documented initiation-source limitations.\n\nSource: [Netgate — WireGuard Limitations](https://docs.netgate.com/pfsense/en/latest/vpn/wireguard/limitations.html).\n\n## Applicability\n\nThis concerns the documented FreeBSD/pfSense WireGuard implementation with HA addressing.\n\n## DSE recommendation\n\nDSE recommends recording the intended public endpoint and initiation direction alongside CARP ownership. Include planned maintenance, hard node loss, and restoration as separate acceptance scenarios. Avoid assuming an outbound NAT workaround makes initiation from a CARP VIP transferable between nodes; the source documents a state-ownership limitation. Coordinate tests with the remote VPN owner so endpoint changes can be observed rather than guessed from a local status indicator. Name maintenance, reboot, and power loss as separate HA acceptance cases. Retain the remote peer’s observed endpoint for each transition and compare it with the intended VIP. Do not use a successful power-off result to close an untested live-maintenance case.\n\n## Verification\n\nUsing an approved nonproduction peer, compare a CARP maintenance transition with a node shutdown. Inspect the observed source address and the peer’s learned endpoint after each event. Confirm which node carries application traffic and repeat restoration before declaring the design suitable for the required maintenance procedure.\n\n## Official reference\n\n[Netgate — WireGuard Limitations](https://docs.netgate.com/pfsense/en/latest/vpn/wireguard/limitations.html). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/test-pfsense-wireguard-carp-maintenance-separately-from-a-powered-off-node/",
                "url": "https://update.dsesecurity.com/updates/test-pfsense-wireguard-carp-maintenance-separately-from-a-powered-off-node/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/test-pfsense-wireguard-carp-maintenance-separately-from-a-powered-off-node/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Test pfSense WireGuard CARP maintenance separately from a powered-off node",
                        "item": "https://update.dsesecurity.com/updates/test-pfsense-wireguard-carp-maintenance-separately-from-a-powered-off-node/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/test-pfsense-wireguard-carp-maintenance-separately-from-a-powered-off-node/#article",
                "identifier": "https://update.dsesecurity.com/updates/test-pfsense-wireguard-carp-maintenance-separately-from-a-powered-off-node/",
                "url": "https://update.dsesecurity.com/updates/test-pfsense-wireguard-carp-maintenance-separately-from-a-powered-off-node/",
                "headline": "Test pfSense WireGuard CARP maintenance separately from a powered-off node",
                "description": "A live former master can respond from a different address and influence the remote peer's endpoint.",
                "abstract": "A live former master can respond from a different address and influence the remote peer's endpoint.",
                "articleBody": "A live former master can respond from a different address and influence the remote peer’s endpoint.\nSource facts\nNetgate warns that WireGuard address selection can behave unexpectedly with CARP. A node entering maintenance can stop owning the VIP yet continue replying from its interface address, causing the remote peer to keep contacting that node. Power-off and reboot differ because that node cannot send the unexpected reply. Letting the remote peer always initiate can work around documented initiation-source limitations.\nSource: Netgate — WireGuard Limitations.\nApplicability\nThis concerns the documented FreeBSD/pfSense WireGuard implementation with HA addressing.\nDSE recommendation\nDSE recommends recording the intended public endpoint and initiation direction alongside CARP ownership. Include planned maintenance, hard node loss, and restoration as separate acceptance scenarios. Avoid assuming an outbound NAT workaround makes initiation from a CARP VIP transferable between nodes; the source documents a state-ownership limitation. Coordinate tests with the remote VPN owner so endpoint changes can be observed rather than guessed from a local status indicator. Name maintenance, reboot, and power loss as separate HA acceptance cases. Retain the remote peer’s observed endpoint for each transition and compare it with the intended VIP. Do not use a successful power-off result to close an untested live-maintenance case.\nVerification\nUsing an approved nonproduction peer, compare a CARP maintenance transition with a node shutdown. Inspect the observed source address and the peer’s learned endpoint after each event. Confirm which node carries application traffic and repeat restoration before declaring the design suitable for the required maintenance procedure.\nOfficial reference\nNetgate — WireGuard Limitations. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:16:28+00:00",
                "dateModified": "2026-10-20T18:34:35+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/test-pfsense-wireguard-carp-maintenance-separately-from-a-powered-off-node/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/test-pfsense-wireguard-carp-maintenance-separately-from-a-powered-off-node/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Test pfSense WireGuard CARP maintenance separately from a powered-off node"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 257,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Netgate — WireGuard Limitations",
                    "url": "https://docs.netgate.com/pfsense/en/latest/vpn/wireguard/limitations.html"
                }
            }
        ]
    }
}