Keep local and VPN traffic above pfSense Multi-WAN policy-routing rules

A gateway on a broad pass rule can send traffic away from routes that should remain local.

Source facts

In pfSense, selecting a gateway or gateway group on a firewall rule policy-routes matching traffic through that selection. Netgate states that traffic intended for other local interfaces, VPNs, MPLS, or normal routing-table decisions must bypass policy routing. The documented method places a matching rule without a selected gateway above the broader gateway-bearing rule. Rule order matters because the first match is used. Netgate also documents additional handling when traffic must stop rather than fall through to another route after a selected gateway fails.

Source: Netgate — Policy routing.

Applicability

This concerns pfSense Multi-WAN rules on the relevant ingress interface. The actual destinations and route exceptions must come from the approved network design rather than a copied example address list.

DSE recommendation

DSE recommends building an explicit exception list for internal services, remote VPN networks, and other destinations that should follow the routing table. Review that list before changing a default pass rule to use a WAN group. Keep the exception rule immediately understandable and document why each destination belongs there. Decide separately which traffic may fail over and which must fail closed. Preserve the previous rule order for rollback, and coordinate testing with owners of remote management and site-to-site applications.

Verification

Test an approved local service, a VPN destination, and an internet destination from the same client. Confirm the intended path for each. During an authorized failure test, check both new connection behavior and the special cases that must stop instead of changing their exit path.

Official reference

Netgate — Policy routing. Reviewed October 15, 2026.