Check firewall-local port conflicts before adding a pfSense port forward

A matching port forward can take precedence over the firewall’s own service on that interface.

Source facts

Netgate explains that port forwards rewrite the destination of incoming packets. They take precedence over services running locally on the firewall and over inbound 1:1 NAT rules. A WAN forward for a port used by the administrative interface can therefore divert that traffic to the internal target on that WAN.

Source: Netgate — Port Forwarding.

Applicability

This applies to pfSense inbound NAT on the matching interface and protocol.

DSE recommendation

DSE recommends listing firewall-local listeners before publishing a new service. Reserve a separate management path and recovery method before changing a port that administrators currently use. Keep the forward and its corresponding firewall permission limited to the intended source population when possible. Record the external address and port separately from the internal target so an overlapping 1:1 mapping or a later service move does not obscure the actual destination. Make the management check a stop condition rather than a follow-up task. Ask a second administrator to confirm the recovery address from a separate authorized session before the forward is committed, and retain the tested recovery method with the service publication record.

Verification

From an authorized external test client, confirm which application answers on the published address and inspect the NAT rule and matching firewall rule. Separately verify the management path. Also test a neighboring unpublished port and retain evidence that the forward did not broaden the intended exposure.

Official reference

Netgate — Port Forwarding. Reviewed October 20, 2026.