Choose pfSense Hybrid NAT when only a few source translations need exceptions

Manual rules do not take effect under every outbound NAT mode.

Source facts

Netgate lists Automatic, Hybrid, Manual, and Disabled outbound NAT modes. Hybrid combines administrator-defined rules with automatic rules for unmatched traffic. Manual honors only manually entered rules, so new internal networks and WANs require explicit maintenance. Rules displayed in the list are not honored unless the selected mode is Hybrid or Manual.

Source: Netgate — Outbound NAT.

Applicability

This concerns pfSense outbound source translation.

DSE recommendation

DSE recommends starting from the smallest required exception. If one application needs a particular source address or source-port behavior, assess Hybrid before taking responsibility for the entire translation inventory. Record which internal and VPN subnets must remain translated, and check 1:1 mappings that take precedence. When Manual mode is necessary, add NAT review to the onboarding checklist for every new routed subnet and WAN circuit. Require an explicit answer about who will maintain ordinary translations after the mode change. Include a newly proposed subnet in the review even if it has not been deployed, and make its NAT onboarding step part of the same network provisioning procedure.

Verification

Use approved test clients from each relevant source network, not just the administrator’s workstation. Compare the observed external address with the intended rule and interface. Confirm that unmatched ordinary traffic still works as designed, and that the selected mode actually activates the manual exception being evaluated.

Official reference

Netgate — Outbound NAT. Reviewed October 20, 2026.