Create floating rules with pfctl for advanced multi-interface policy

Floating rules in pfSense are stored under the [filter] section but applied across multiple interfaces, and they live in the pf anchor 'floating' rather than a per-interface anchor. Internally, when you set a floating rule, pfSense writes it with an empty interface or multiple interface entries and the GUI marks it as floating. The underlying pf(4) engine loads these into the global ruleset ahead of interface rules, so they can implement cross-zone policy, policy routing, and traffic shaping hooks. Using pfctl you can inspect the compiled rules and verify anchor ordering with pfctl -sr and pfctl -a floating -sr.

Typical production deployments use floating rules for stateful failover between WANs, blocking RFC1918 spoofing on ingress, and applying QoS queues that span LAN, WAN, and VPN. They are also the standard mechanism for policy-based routing where specific source subnets must exit a particular gateway. In multi-WAN setups, floating rules with gateway groups let you steer traffic deterministically, which is impossible with per-interface rules alone.

Security-wise, floating rules evaluate before interface rules, so a misconfigured block can silently kill all traffic, including management access. Always keep a console or IPMI path. Performance impact is minimal but ordering matters: too many floating rules increase the linear scan cost of the pf ruleset. Common pitfalls include forgetting that 'quick' changes semantics, that direction in/out applies relative to the interface, and that reply-to must be set correctly for asymmetric routing.

> System.Execute()

# Inspect current floating anchor on pfSense 2.7.x
pfctl -a floating -sr

# Add a floating rule blocking RFC1918 spoofing on WAN ingress
# Equivalent GUI: Firewall > Rules > Floating > Add
cat >> /tmp/spoof.conf <<'EOF'
block in log quick on wan from 10.0.0.0/8 to any label "spoof-rfc1918"
block in log quick on wan from 172.16.0.0/12 to any label "spoof-rfc1918"
block in log quick on wan from 192.168.0.0/16 to any label "spoof-rfc1918"
EOF

# Load into anchor (do NOT replace main ruleset)
pfctl -a floating -f /tmp/spoof.conf

# Verify
pfctl -a floating -sr
pfctl -si | grep -i states

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-3E416D0792F9