Define what pfSense permits outside a scheduled rule window

An inactive scheduled rule disappears from consideration; its action is not reversed.

Source facts

Netgate states that a time-based rule behaves as absent outside its schedule. A scheduled pass therefore needs a separate applicable block if access must stop outside the window. Schedules can contain several ranges, use local time, and cannot express a single range crossing midnight.

Source: Netgate — Time Based Rules.

Applicability

This concerns pfSense scheduled firewall rules, rather than application account expiry or an assurance that every previously established session terminates at the boundary.

DSE recommendation

DSE recommends writing the desired outcome inside and outside the window before creating the schedule. Inspect rules underneath it for broader passes that would still permit access. Split overnight access into ranges that match the actual calendar days. Record the firewall time zone and the operational owner of holidays or temporary exceptions. Keep the schedule name meaningful to the business requirement rather than relying on a time range that may be reused elsewhere. Include an overnight example and a normal business-day example in the acceptance plan. Ask the access owner to approve the outside-window result explicitly, including whether a separate rule should deny the request or allow it under another documented business exception.

Verification

In an approved test, attempt fresh connections immediately before, within, and after the scheduled window. Check the firewall’s displayed clock and matching rule for each attempt. Review existing-session handling separately instead of assuming a successful new-connection test also proves immediate session termination.

Official reference

Netgate — Time Based Rules. Reviewed October 20, 2026.