pfSense

I came across a subtle issue while organizing firewall rules across multiple interface groups.

This behavior has also been discussed previously on the Netgate forum:
https://forum.netgate.com/topic/190288/firewall-rule-processing-order-whith-multiple-interface-groups

The documentation describes the overall firewall rule processing order:
https://docs.netgate.com/pfsense/en/latest/nat/process-order.html

However, it does not describe what happens when a single interface belongs to multiple interface groups.

Based on testing and the discussion linked above, the current behavior appears to be that rules from multiple interface groups are evaluated in alphabetical order of the interface group names. While this may be the current implementation, it is not documented, and renaming an interface group can change the effective rule evaluation order after the ruleset is regenerated.

I would like to request a feature to allow administrators to explicitly define the processing order (or priority) of interface groups, rather than relying on the current implicit ordering.

This would make rule evaluation deterministic, easier to understand, and less susceptible to unintended changes caused by renaming interface groups. It would also make firewall policies easier to maintain in more complex environments where interfaces are members of multiple groups.