Document what pfSense XMLRPC synchronization deliberately leaves local
Synchronized firewall rules do not prove that both HA nodes have matching local configuration.
Read the guideDSE security knowledge hubNetworks & Infrastructure
Networks & Infrastructure
Knowledge
Page 33 of the DSE Networks & Infrastructure knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide Networks & Infrastructure knowledge center
Guidance for resilient networks, Wi-Fi, firewalls, cabling, power, exposure reduction, and connected-device planning.
DSE post stream
1,594 articlesNetworks & Infrastructure
Check resolved addresses before using a pfSense hostname alias for a public service
A DNS-backed firewall alias is a periodically refreshed address set, not a hostname-aware web filter.
Read the guide
Read both NAT addresses and both directions in the pfSense state table
The state table can distinguish a translated connection from one that has not received a reply.
Read the guide
Do not equate Cloudflare’s WARP posture check with enrollment in your organization
The documented WARP check also accepts the consumer client.
Read the guide
Keep Access client-certificate trust separate from the website server certificate
The CA uploaded for Access mTLS validates clients, not the certificate shown by the website.
Read the guide
Recheck the full Cloudflare Access policy when adding a more specific application path
A child-path application can replace the parent policy instead of adding another restriction.
Read the guide
Keep machine access authenticated instead of creating a Cloudflare Access Bypass
Bypass removes Access enforcement and its request logging for matching traffic.
Read the guide
Review local account names as well as network permission in Tailscale SSH
Permitting port 22 and permitting a local login identity are separate decisions.
Read the guide
Decide whether Tailscale Serve should survive a restart
Background sharing can return automatically after reboot; foreground sharing requires another start.
Read the guide
Approve the public audience before turning a private service into a Tailscale Funnel
A Funnel URL is reachable by internet users who do not belong to the tailnet.
Read the guide