Check split DNS before adding pfSense NAT reflection

Check internal name resolution and port consistency when a public service name fails from inside the LAN.

Source facts

Netgate recommends split DNS as an alternative to NAT reflection for local access to local services. The same hostname resolves to a public address outside and a private address inside. Internal clients can then reach the local server directly. The guide highlights an important limit: the internal and external service port must be the same for this approach. Certain reflection arrangements also mask the original client address.

Source: Netgate — pfSense NAT Reflection.

Applicability

Use this for services hosted behind pfSense when internal and external access behave differently. Verify the actual DNS infrastructure and port-forward design before selecting the remedy.

DSE recommendation

DSE recommends collecting the hostname, internal and external resolved addresses, public port, server port, and certificate name before changing firewall settings. Compare a LAN client and a genuinely external client. If split DNS fits the port design, coordinate the needed records with the DNS owner and preserve unrelated records. If translated ports prevent that approach, review the documented reflection mode and logging implications instead of applying a global option without an acceptance plan.

Verification

Verify DNS answers from both locations and complete the intended application transaction using the service hostname. Confirm certificate validation and the client address visible to the application. Record the selected design and retest from representative internal networks after the change.

Official reference

Netgate — pfSense NAT Reflection. Reviewed October 14, 2026.