# Define what pfSense permits outside a scheduled rule window

> An inactive scheduled rule disappears from consideration; its action is not reversed.

- Canonical URL: https://update.dsesecurity.com/updates/define-what-pfsense-permits-outside-a-scheduled-rule-window/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:15:54+00:00
- Modified: 2026-10-20T18:34:34+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

An inactive scheduled rule disappears from consideration; its action is not reversed.

## Potentially affected

This concerns pfSense scheduled firewall rules, rather than application account expiry or an assurance that every previously established session terminates at the boundary.

## DSE recommendation

DSE recommends writing the desired outcome inside and outside the window before creating the schedule.

## Article

An inactive scheduled rule disappears from consideration; its action is not reversed.

## Source facts

Netgate states that a time-based rule behaves as absent outside its schedule. A scheduled pass therefore needs a separate applicable block if access must stop outside the window. Schedules can contain several ranges, use local time, and cannot express a single range crossing midnight.

Source: [Netgate — Time Based Rules](https://docs.netgate.com/pfsense/en/latest/firewall/time-based-rules.html).

## Applicability

This concerns pfSense scheduled firewall rules, rather than application account expiry or an assurance that every previously established session terminates at the boundary.

## DSE recommendation

DSE recommends writing the desired outcome inside and outside the window before creating the schedule. Inspect rules underneath it for broader passes that would still permit access. Split overnight access into ranges that match the actual calendar days. Record the firewall time zone and the operational owner of holidays or temporary exceptions. Keep the schedule name meaningful to the business requirement rather than relying on a time range that may be reused elsewhere. Include an overnight example and a normal business-day example in the acceptance plan. Ask the access owner to approve the outside-window result explicitly, including whether a separate rule should deny the request or allow it under another documented business exception.

## Verification

In an approved test, attempt fresh connections immediately before, within, and after the scheduled window. Check the firewall’s displayed clock and matching rule for each attempt. Review existing-session handling separately instead of assuming a successful new-connection test also proves immediate session termination.

## Official reference

[Netgate — Time Based Rules](https://docs.netgate.com/pfsense/en/latest/firewall/time-based-rules.html). Reviewed October 20, 2026.

## Primary reference

- Name: Netgate — Time Based Rules
- Authority: docs.netgate.com
- URL: https://docs.netgate.com/pfsense/en/latest/firewall/time-based-rules.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Define what pfSense permits outside a scheduled rule window,” DSE Security, https://update.dsesecurity.com/updates/define-what-pfsense-permits-outside-a-scheduled-rule-window/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.