Reapply pfSense services after restoring only one configuration area

A partial restore does not automatically reboot or activate the restored section.

Source facts

Netgate warns that restoring a single configuration area does not trigger a reboot or reapply that part of the running configuration. An administrator must reboot or refresh the relevant subsystem using an appropriate action. The backup file must itself contain only the selected area; choosing an area does not extract it from a complete backup.

Source: Netgate — Restoring from Backups.

Applicability

This concerns partial pfSense GUI restores using a compatible configuration revision.

DSE recommendation

DSE recommends planning the activation step before beginning a partial restore. Identify the responsible subsystem and whether its supported refresh can avoid a broader interruption. Capture a complete current backup first and keep the area export labeled with its origin and revision. Do not report the change complete merely because the upload succeeded or the saved fields now display the expected values. Coordinate any required reboot with the service owners and management-access plan. Write separate completion criteria for uploading the area and activating the subsystem. Have the operator record both times during rehearsal. If the activation method is unclear for that area, resolve it on the isolated target before scheduling a production partial restore.

Verification

In an isolated rehearsal, compare saved configuration with running behavior before and after the chosen refresh. Confirm the relevant rules, listener, or service state changed as intended. Verify a permitted transaction and a denied case, and record the activation action separately from the file upload result.

Official reference

Netgate — Restoring from Backups. Reviewed October 20, 2026.