Pair pfSense Ethernet-rule exceptions in both directions when required

Layer 2 rules are stateless and cannot match on interfaces that do not carry Ethernet information.

Source facts

Netgate documents Ethernet rules as stateless. An exception to a block may need inbound and outbound rules with reversed source and destination. The source warns that applying an Ethernet rule to a non-Layer-2 tunnel produces no error even though it cannot match. Manual Ethernet rules are evaluated before automatically managed captive-portal rules.

Source: Netgate — Ethernet (Layer 2) Rules.

Applicability

This concerns the documented pfSense Plus Ethernet-rule feature.

DSE recommendation

DSE recommends identifying the actual Ethernet boundary before using MAC or EtherType criteria. Describe the reverse direction explicitly and check whether an exception must cover it. Review any captive-portal interface for interference before enabling a broad manual rule. Avoid using a silent absence of errors as evidence that a rule is active. Keep a recovery connection available when changing Layer 2 admission because mistakes can affect supporting traffic as well as application packets. For every proposed exception, put the forward and reverse header criteria beside each other for review. Include one unsuitable interface as a design check, not an uncontrolled production experiment, and require a positive counter or capture before declaring a Layer 2 rule effective.

Verification

On an isolated test path, generate both directions of the intended exchange and inspect rule counters or captures. Try the intended denied traffic separately. Confirm that the selected interface carries Layer 2 headers and that portal behavior, if present, still follows the approved workflow.

Official reference

Netgate — Ethernet (Layer 2) Rules. Reviewed October 20, 2026.