Keep pfSense WAN reply paths on actual WAN rule tabs

A convenient group tab does not receive the same reply-to treatment as a WAN interface tab.

Source facts

Netgate advises against combining multiple WANs in interface groups. Rules on actual WAN-type interfaces receive reply-to handling so responses leave through the interface where the connection arrived. Group rules do not receive that handling and generally behave as expected only for the WAN using the default gateway.

Source: Netgate — Interface Groups.

Applicability

This concerns pfSense interface-group rules on multiple WANs.

DSE recommendation

DSE recommends keeping externally initiated service permissions on the relevant WAN tabs when the design relies on correct symmetric replies. If consolidating repetitive rules, review the packet-return behavior before choosing a group for convenience. Document why a shared internal group is appropriate and why a WAN exception remains separate. Include published services on non-default WANs in acceptance tests rather than checking only the preferred Internet connection. Require one genuinely external test connection through each WAN, with the responding interface identified. Keep a shared description or maintenance checklist for equivalent WAN rules if helpful, but review the actual per-interface entries and their return path before accepting a convenience-based consolidation.

Verification

From authorized external locations, initiate new connections through each WAN and inspect the return interface. Compare the active rule and state with the intended WAN-tab configuration. Confirm that a service on a non-default WAN replies through that same circuit instead of concluding success from a test that used only the default WAN.

Official reference

Netgate — Interface Groups. Reviewed October 20, 2026.