# Choose what a pfSense gateway monitor actually proves

> A responding local modem and a usable upstream internet path are different observations.

- Canonical URL: https://update.dsesecurity.com/updates/pfsense-gateway-monitor-target-failure-scope/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:33:37+00:00
- Modified: 2026-10-15T13:36:17+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

A responding local modem and a usable upstream internet path are different observations.

## Potentially affected

This applies to pfSense gateway monitoring and Multi-WAN decisions. A successful probe to one address does not demonstrate that every DNS service, application, or destination is healthy.

## DSE recommendation

DSE recommends choosing a stable permitted target whose location matches the failure boundary the WAN policy needs to detect.

## Article

A responding local modem and a usable upstream internet path are different observations.

## Source facts

pfSense gateway monitoring uses ICMP probes to a configured Monitor IP and reports latency and packet loss for that target. By default, the target is the gateway address, which may be a local modem or provider device. Netgate explains that an upstream target can better reveal failures beyond that first hop. Each gateway must use a unique monitor address, and pfSense normally adds a route to send probes through the expected gateway. Disabling monitoring differs from disabling actions triggered by monitoring changes.

Source: [Netgate — Gateway settings](https://docs.netgate.com/pfsense/en/latest/routing/gateway-configure.html).

## Applicability

This applies to pfSense gateway monitoring and Multi-WAN decisions. A successful probe to one address does not demonstrate that every DNS service, application, or destination is healthy.

## DSE recommendation

DSE recommends choosing a stable permitted target whose location matches the failure boundary the WAN policy needs to detect. Document why the target was selected and which services it cannot validate. Review generated monitor routes so a probe cannot succeed through the wrong exit. Decide deliberately whether monitoring should trigger failover or only provide observations. Avoid masking a real upstream issue by simply disabling monitoring, and use separate application checks when the requirement is more specific than general path reachability.

## Verification

Confirm the monitor target and route for each gateway, then compare gateway status with an approved application test. During a controlled failure, verify the expected monitoring action and recovery behavior. Keep latency and loss evidence tied to the chosen target rather than describing it as universal internet availability.

## Official reference

[Netgate — Gateway settings](https://docs.netgate.com/pfsense/en/latest/routing/gateway-configure.html). Reviewed October 15, 2026.

## Primary reference

- Name: Netgate — Gateway settings
- Authority: docs.netgate.com
- URL: https://docs.netgate.com/pfsense/en/latest/routing/gateway-configure.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Choose what a pfSense gateway monitor actually proves,” DSE Security, https://update.dsesecurity.com/updates/pfsense-gateway-monitor-target-failure-scope/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.