Keep pfSense's generated QinQ interface group under the QinQ configuration's control
Manually altering the automatic group can break it because its interfaces are not ordinary assigned members.
Read the guideDSE security knowledge hubNetworks & Infrastructure
Networks & Infrastructure
Knowledge
Page 20 of the DSE Networks & Infrastructure knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide Networks & Infrastructure knowledge center
Guidance for resilient networks, Wi-Fi, firewalls, cabling, power, exposure reduction, and connected-device planning.
DSE post stream
1,594 articlesNetworks & Infrastructure
Reapply pfSense services after restoring only one configuration area
A partial restore does not automatically reboot or activate the restored section.
Read the guide
Keep both pfSense AutoConfigBackup recovery secrets outside the firewall
The device key identifies backups, while the encryption password is needed to read their contents.
Read the guide
Choose pfSense backup contents for the recovery task, not just the XML filename
Package settings, graph history, volatile databases, and SSH host identity are separate backup choices.
Read the guide
Review every pfSense IPsec tunnel before changing the global filter mode
Enabling assigned-interface filtering can break tunnel-mode traffic elsewhere on the same firewall.
Read the guide
Give pfSense forwarding DNS a viable route through each WAN
A second Internet circuit is insufficient if all configured resolvers depend on the failed first circuit.
Read the guide
Pair pfSense Ethernet-rule exceptions in both directions when required
Layer 2 rules are stateless and cannot match on interfaces that do not carry Ethernet information.
Read the guide
Route firewall-originated pfSense services separately from client policy rules
A working client failover rule does not establish the path used by the firewall's own daemons.
Read the guide
Keep native VLAN behavior out of pfSense trust-boundary assumptions
A tagged-network design still needs an explicit policy for untagged traffic on trunks.
Read the guide
Choose whether pfSense bridge members or the bridge interface own filtering
Rules on an unnumbered member cannot rely on that member's address macros.
Read the guide