# Review every pfSense IPsec tunnel before changing the global filter mode

> Enabling assigned-interface filtering can break tunnel-mode traffic elsewhere on the same firewall.

- Canonical URL: https://update.dsesecurity.com/updates/review-every-pfsense-ipsec-tunnel-before-changing-the-global-filter-mode/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:06+00:00
- Modified: 2026-10-20T18:34:34+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Enabling assigned-interface filtering can break tunnel-mode traffic elsewhere on the same firewall.

## Potentially affected

This concerns pfSense's IPsec Filter Mode and its firewall-wide compatibility consequence.

## DSE recommendation

DSE recommends inventorying every IPsec phase-2 mode before changing the setting, including dormant partner and mobile configurations.

## Article

Enabling assigned-interface filtering can break tunnel-mode traffic elsewhere on the same firewall.

## Source facts

Netgate documents a default IPsec-tab filter mode and an alternative that filters on assigned interfaces. The latter enables expected per-VTI rules, NAT, and reply-to handling for VTI or transport mode. Its stated downside is that all tunnel-mode traffic is dropped. The guide recommends that alternative when all tunnels use VTI or transport mode.

Source: [Netgate — IPsec and firewall rules](https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/firewall-rules.html).

## Applicability

This concerns pfSense’s IPsec Filter Mode and its firewall-wide compatibility consequence.

## DSE recommendation

DSE recommends inventorying every IPsec phase-2 mode before changing the setting, including dormant partner and mobile configurations. Treat conversion as an architectural change when tunnel-mode and VTI connections coexist. Document which rule tabs own inbound decrypted traffic and which local-interface tabs govern locally initiated traffic. Avoid enabling the alternative solely to solve one VTI NAT issue without an impact plan for unrelated tunnels. Make the complete tunnel inventory an approval prerequisite, with a mode and service owner for each entry. Ask owners of dormant partner tunnels to participate in the review. An improvement to one VTI path should not close the change while another tunnel mode remains incompatible.

## Verification

In a lab matching the planned tunnel mix, test an allowed transaction through every mode before and after the proposed filter setting. Confirm the active rule tab, NAT requirement, and return path for VTI. Record any tunnel-mode incompatibility and resolve it in the design before production change approval.

## Official reference

[Netgate — IPsec and firewall rules](https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/firewall-rules.html). Reviewed October 20, 2026.

## Primary reference

- Name: Netgate — IPsec and firewall rules
- Authority: docs.netgate.com
- URL: https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/firewall-rules.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Review every pfSense IPsec tunnel before changing the global filter mode,” DSE Security, https://update.dsesecurity.com/updates/review-every-pfsense-ipsec-tunnel-before-changing-the-global-filter-mode/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.