# Choose pfSense Hybrid NAT when only a few source translations need exceptions

> Manual rules do not take effect under every outbound NAT mode.

- Canonical URL: https://update.dsesecurity.com/updates/choose-pfsense-hybrid-nat-when-only-a-few-source-translations-need-exceptions/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:15:59+00:00
- Modified: 2026-10-20T18:34:34+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Manual rules do not take effect under every outbound NAT mode.

## Potentially affected

This concerns pfSense outbound source translation.

## DSE recommendation

DSE recommends starting from the smallest required exception.

## Article

Manual rules do not take effect under every outbound NAT mode.

## Source facts

Netgate lists Automatic, Hybrid, Manual, and Disabled outbound NAT modes. Hybrid combines administrator-defined rules with automatic rules for unmatched traffic. Manual honors only manually entered rules, so new internal networks and WANs require explicit maintenance. Rules displayed in the list are not honored unless the selected mode is Hybrid or Manual.

Source: [Netgate — Outbound NAT](https://docs.netgate.com/pfsense/en/latest/nat/outbound.html).

## Applicability

This concerns pfSense outbound source translation.

## DSE recommendation

DSE recommends starting from the smallest required exception. If one application needs a particular source address or source-port behavior, assess Hybrid before taking responsibility for the entire translation inventory. Record which internal and VPN subnets must remain translated, and check 1:1 mappings that take precedence. When Manual mode is necessary, add NAT review to the onboarding checklist for every new routed subnet and WAN circuit. Require an explicit answer about who will maintain ordinary translations after the mode change. Include a newly proposed subnet in the review even if it has not been deployed, and make its NAT onboarding step part of the same network provisioning procedure.

## Verification

Use approved test clients from each relevant source network, not just the administrator’s workstation. Compare the observed external address with the intended rule and interface. Confirm that unmatched ordinary traffic still works as designed, and that the selected mode actually activates the manual exception being evaluated.

## Official reference

[Netgate — Outbound NAT](https://docs.netgate.com/pfsense/en/latest/nat/outbound.html). Reviewed October 20, 2026.

## Primary reference

- Name: Netgate — Outbound NAT
- Authority: docs.netgate.com
- URL: https://docs.netgate.com/pfsense/en/latest/nat/outbound.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Choose pfSense Hybrid NAT when only a few source translations need exceptions,” DSE Security, https://update.dsesecurity.com/updates/choose-pfsense-hybrid-nat-when-only-a-few-source-translations-need-exceptions/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.