I am running business edition. l have tried two upgrades so far, they fail because of my qfeeds manual rules I've created. it pops up under system status a RED circle and lists qfeeds rules. (I do not have the qfeeds plugin installed)
I manually added my qfeeds blocklist under unbound : URLs of Blocklists
then I manually created a firewall alias with the URL tables (ip). and updates every 8-12 hours.
this has worked perfectly for months.
but why is this causing a 26.7 upgrade fail?
I keep having to restore a snapshot because the firewall is no longer passing traffic.
I restored the broken upgrade. what does this error mean:
2026-08-18T05:58:53-04:00
Error
firewall
/usr/local/etc/rc.bootup: The command </sbin/pfctl -f '/tmp/rules.debug.old'> returned exit code 1 and the output was "/tmp/rules.debug.old:246: route-to, reply-to and dup-to are not supported on block rules /tmp/rules.debug.old:246: skipping rule due to errors /tmp/rules.debug.old:246: rule expands to no valid combination /tmp/rules.debug.old:256: route-to, reply-to and dup-to are not supported on block rules /tmp/rules.debug.old:256: skipping rule due to errors /tmp/rules.debug.old:256: rule expands to no valid combination /tmp/rules.debug.old:265: route-to, reply-to and dup-to are not supported on block rules /tmp/rules.debug.old:265: skipping rule due to errors /tmp/rules.debug.old:265: rule expands to no valid combination pfctl: Syntax error in config file: pf rules not loaded"
2026-08-18T05:58:50-04:00
Error
firewall
There were error(s) loading the rules: /tmp/rules.debug:246: route-to, reply-to and dup-to are not supported on block rules - The line in question reads [246]: block in log quick on igc1 reply-to ( igc1 IPaddress) inet from {any} to $qfeeds label "my "key # qfeedsdestination
2nd attachment of rule as I ran out of attach space
Looks like a partial upgrade where packages were not upgraded.
Logs are visible via: # opnsense-update -gG
The usual fix is:
# opnsense-update -up -a FreeBSD:15:amd64/26.7
Cheers,
Franco
I decided to give it try number 4 this morning
I have read on the forums to remove the os-cpu-microcode-intel plugin on certain hardware to fix update issues. I thought for giggles to remove it for my Dec740 appliance. the process went completely different and worked and now I am updated.
was this expected to have to remove the and cpu plugin?
should I reinstall the plugin now?
To my knowledge AMD wasn't affected and Intel one isn't necessary on DEC hardware and won't load anyway. I'm unsure what problem we're trying to solve.
Cheers,
Franco