Review every permitted protocol when using pfSense 1:1 NAT

A broad WAN pass combined with 1:1 NAT exposes more than a single port forward would.

Source facts

Netgate documents 1:1 NAT as an external-to-internal address mapping that preserves ports. Inbound packets are subsequently evaluated against firewall rules using the internal target. Unlike a single-port forward, a 1:1 mapping combined with an allow-all WAN rule can expose all services on the mapped host. Outbound 1:1 translation takes precedence over outbound NAT rules.

Source: Netgate — 1:1 NAT.

Applicability

This concerns pfSense address mappings for a host or aligned equal-sized subnets.

DSE recommendation

DSE recommends creating an explicit service list before introducing a 1:1 mapping. Review the external-interface rules against the internal destination address and remove inherited broad permissions that are unnecessary. Include outbound identity in the change review because the same host may start presenting the mapped public address. Keep host-based access controls and maintenance responsibilities documented alongside the firewall configuration. Give the reviewer a protocol-by-protocol exposure table rather than an instruction to test the server. Include services that should remain private and the expected public identity for outbound traffic. Require an owner for every permitted entry before accepting the mapping.

Verification

From an approved external location, test the authorized services and representative denied ports. Inspect the translated inbound destination and outbound source independently. Confirm that a more specific port forward has not redirected one service to a different host than the general 1:1 mapping suggests.

Official reference

Netgate — 1:1 NAT. Reviewed October 20, 2026.