# Pair pfSense Ethernet-rule exceptions in both directions when required

> Layer 2 rules are stateless and cannot match on interfaces that do not carry Ethernet information.

- Canonical URL: https://update.dsesecurity.com/updates/pair-pfsense-ethernet-rule-exceptions-in-both-directions-when-required/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:04+00:00
- Modified: 2026-10-20T18:34:34+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Layer 2 rules are stateless and cannot match on interfaces that do not carry Ethernet information.

## Potentially affected

This concerns the documented pfSense Plus Ethernet-rule feature.

## DSE recommendation

DSE recommends identifying the actual Ethernet boundary before using MAC or EtherType criteria.

## Article

Layer 2 rules are stateless and cannot match on interfaces that do not carry Ethernet information.

## Source facts

Netgate documents Ethernet rules as stateless. An exception to a block may need inbound and outbound rules with reversed source and destination. The source warns that applying an Ethernet rule to a non-Layer-2 tunnel produces no error even though it cannot match. Manual Ethernet rules are evaluated before automatically managed captive-portal rules.

Source: [Netgate — Ethernet (Layer 2) Rules](https://docs.netgate.com/pfsense/en/latest/firewall/ethernet-rules.html).

## Applicability

This concerns the documented pfSense Plus Ethernet-rule feature.

## DSE recommendation

DSE recommends identifying the actual Ethernet boundary before using MAC or EtherType criteria. Describe the reverse direction explicitly and check whether an exception must cover it. Review any captive-portal interface for interference before enabling a broad manual rule. Avoid using a silent absence of errors as evidence that a rule is active. Keep a recovery connection available when changing Layer 2 admission because mistakes can affect supporting traffic as well as application packets. For every proposed exception, put the forward and reverse header criteria beside each other for review. Include one unsuitable interface as a design check, not an uncontrolled production experiment, and require a positive counter or capture before declaring a Layer 2 rule effective.

## Verification

On an isolated test path, generate both directions of the intended exchange and inspect rule counters or captures. Try the intended denied traffic separately. Confirm that the selected interface carries Layer 2 headers and that portal behavior, if present, still follows the approved workflow.

## Official reference

[Netgate — Ethernet (Layer 2) Rules](https://docs.netgate.com/pfsense/en/latest/firewall/ethernet-rules.html). Reviewed October 20, 2026.

## Primary reference

- Name: Netgate — Ethernet (Layer 2) Rules
- Authority: docs.netgate.com
- URL: https://docs.netgate.com/pfsense/en/latest/firewall/ethernet-rules.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Pair pfSense Ethernet-rule exceptions in both directions when required,” DSE Security, https://update.dsesecurity.com/updates/pair-pfsense-ethernet-rule-exceptions-in-both-directions-when-required/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.