Policy Based Routing Not Using Interface Criteria

  • Hello,

    I was goofing with Policy Based Routing (PBR) and noticed that the "interface" criteria isn't applied.  For example, if I have 3 pfsense interfaces as follows:

    –----------                    -------------
    external net ------ PfSense - LAN A -------- DLP Host -
       em1               ------------   em2           -------------
                                  |-- LAN B  (

    Objective: route some traffic to a transparent DLP solution - I need to keep the entire flow going through the DLP solution.


    • I created a PBR rule on interface em0 that said route traffic from source host to DLP host (

    • Not that it matters, but I created a "return" PBR rule on inteface em1 that said traffic on interface em1 with a destination of should be routed to the DLP host (

    • When I ping a host on the external network from I get a TTL time exceeded message from the DLP host.  I can see that icmp echo request rattle around between interface em2 and the DLP host until the TTL reaches zero.  I would not have expected this because I would have expected that any traffic arriving through interface em2 with a source address of would have taken the default route and not been policy routed.

    Also, not that it matters but I also tried creating these rules as floating rules with the exact same results (I tied the rule to an interface and gave it a direction of "in")

    Anyway, I was wondering if this was a known limitation, by design, or a bug.

    I'm on version 2.0.2-RELEASE (amd64)



  • bump