# Check firewall-local port conflicts before adding a pfSense port forward

> A matching port forward can take precedence over the firewall's own service on that interface.

- Canonical URL: https://update.dsesecurity.com/updates/check-firewall-local-port-conflicts-before-adding-a-pfsense-port-forward/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:15:56+00:00
- Modified: 2026-10-20T18:34:34+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

A matching port forward can take precedence over the firewall's own service on that interface.

## Potentially affected

This applies to pfSense inbound NAT on the matching interface and protocol.

## DSE recommendation

DSE recommends listing firewall-local listeners before publishing a new service.

## Article

A matching port forward can take precedence over the firewall’s own service on that interface.

## Source facts

Netgate explains that port forwards rewrite the destination of incoming packets. They take precedence over services running locally on the firewall and over inbound 1:1 NAT rules. A WAN forward for a port used by the administrative interface can therefore divert that traffic to the internal target on that WAN.

Source: [Netgate — Port Forwarding](https://docs.netgate.com/pfsense/en/latest/nat/port-forwards.html).

## Applicability

This applies to pfSense inbound NAT on the matching interface and protocol.

## DSE recommendation

DSE recommends listing firewall-local listeners before publishing a new service. Reserve a separate management path and recovery method before changing a port that administrators currently use. Keep the forward and its corresponding firewall permission limited to the intended source population when possible. Record the external address and port separately from the internal target so an overlapping 1:1 mapping or a later service move does not obscure the actual destination. Make the management check a stop condition rather than a follow-up task. Ask a second administrator to confirm the recovery address from a separate authorized session before the forward is committed, and retain the tested recovery method with the service publication record.

## Verification

From an authorized external test client, confirm which application answers on the published address and inspect the NAT rule and matching firewall rule. Separately verify the management path. Also test a neighboring unpublished port and retain evidence that the forward did not broaden the intended exposure.

## Official reference

[Netgate — Port Forwarding](https://docs.netgate.com/pfsense/en/latest/nat/port-forwards.html). Reviewed October 20, 2026.

## Primary reference

- Name: Netgate — Port Forwarding
- Authority: docs.netgate.com
- URL: https://docs.netgate.com/pfsense/en/latest/nat/port-forwards.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check firewall-local port conflicts before adding a pfSense port forward,” DSE Security, https://update.dsesecurity.com/updates/check-firewall-local-port-conflicts-before-adding-a-pfsense-port-forward/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.