Messages

Also, a  DNAT rule may help redirect your clients to your DNS server if they ever try to reach an external service.

[- I would have upgraded my FreeBSD Bootloader at this point to avoid any issues in the future !!]

- Uninstalled os-cpu-microcode-intel plugin
 - Upgraded from 26.1.11_10 to 26.7
 - Automatic reboot
- I would have upgraded my FreeBSD Bootloader at this point to avoid any issues in the future !!
 - Upgraded from 26.7 to 26.7.3_11
 - Automatic reboot
 - Reinstalled os-cpu-microcode-intel plugin
 - Manual reboot

:)

Good point, but as I said, I am late-loading the microcode.

Also, I had enough emotions for a Sunday already without upgrading the bootloader... ;P

Jokes aside, upgrading the bootloader is the next planned step, but I'm a couch potato and didn't want to remove my FW from the rack in case anything went wrong.

OK, this time it took me a bit longer than usual to upgrade, given the reported CPU microcode issues.

Today, I finally decided to take the leap and go ahead with the upgrade.

For what it's worth, this is the path I've taken:

 - Uninstalled os-cpu-microcode-intel plugin
 - Upgraded from 26.1.11_10 to 26.7
 - Automatic reboot
 - Upgraded from 26.7 to 26.7.3_11
 - Automatic reboot
 - Reinstalled os-cpu-microcode-intel plugin
 - Manual reboot

My unit works like a charm; all services loaded and no issues whatsoever; hardware and running features as per signature.

For the sake of completeness, the microcode plugin is currently running in late load mode.

Usual round of applause to the team and the community for yet another amazing release.

Thank you

Hey there,

Interesting post.

I also run OPNSense on a Protectli (VP2420), but I am still postponing the upgrade due to reported issues with reverse proxies and CPU Microcode, so this time I'll probably wait for the first minor release.

Would you mind sharing your current feature set? Just for me to have an idea.

Well, in my experience, I have always upgraded between major releases directly via GUI, and it always went smoothly.

Given the arrival of the new rule interfaces, I was thinking about a clean install for 26.1, but being a couch potato (and not wanting to climb up to the rack cabinet to take the firewall out), I proceeded with a direct upgrade as usual.

It went fine, as usual.

All that being said, everything depends on your specific needs.

Sooner or later, I will perform a clean install, mostly because I want to switch from UFS to ZFS; apart from that, I would probably go with a direct upgrade all the time.

Just upgraded to 26.1 and it went smoothly as always.

After upgrading, I removed some stale configurations of old plug-ins and uninstalled the legacy ISC plug-in, as I had switched to Kea a few releases ago.

For the foreseeable future, I plan to migrate to the new rule interface, as I'm pretty eager to test the Divert IPS mode, given the potential beneficial impact it may have on overall system performance.

All that being said, I know I say this every time I perform an upgrade, but I really want to congratulate the team for this upteenth smooth experience. I deal with firewalls for a living, and such smooth transitions between major releases are never to be taken for granted.

Your level of dedication and the quality of your work are simply insane!

Did you take a look at this topic?

https://forum.opnsense.org/index.php?topic=9741.0

Hi there,

What issue are you facing in enabling it?

Also, do you plan to monitor the WAN-side or the LAN-side?

I just got this rather scary message during the update to 25.7.6. The update appeared to stop.

I couldn't log in at the console, I got this error:

Password:
sh: /usr/local/libexec/opnsense-auth: not found
Login incorrect

The GUI then gave a 404 error.

After a couple of minutes it sprang back into life.

I've never seen this behaviour before - is it expected?

The update appears to have now completed successfully, as far as I can tell.

I had the same "Danger. Unexpected error, check log for details" error but when I refreshed the OPNsense main dashboard page, version updated to 25.7.6 and a check for updates came back with "There are no updates available on the selected mirror".

I am reluctant to reboot in case I'm left with a broken OPNsense.

Is there anything I can check to ensure a reboot will succeed?

Same here. I received the error message, but after refreshing, everything is running fine.

Have not rebooted yet, due to the same concern.

Upgrade to release 25.7.6 went pretty smoothly except for the already announced hiccup related to the package manager upgrade.

The system appears to be stable, especially Suricata running in IPS mode and behaving just fine.

HW and Feature set are as per the signature.

Thanks to the developers for yet another great release.

Finally upgraded.

From 25.1.12 to 25.7, then from 25.7 to 25.7.1_1.

All went smoothly, no error, no crash, no kernel panic.

FWIW, I had the cpu-microcode plugin already installed before performing the upgrades.

My HW is stated in my signature.

Round of applause to the developers for the usually excellent job.

My Protectli NUC upgraded with no issues - I have os-cpu-microcode-intel installed

What model do you have? I have a VP2420 and plan to upgrade during the weekend.

Sorry for delay in reply - I have a VP2410, so the older version of the one you have

Thank you for replying.

I still have to try the upgrade, as my last weekend was a mess.

Hopefully, I will try over the next one.

My Protectli NUC upgraded with no issues - I have os-cpu-microcode-intel installed

What model do you have? I have a VP2420 and plan to upgrade during the weekend.

The last firmware upgrade (25.1.6_4) fixed it for me.


Versions
OPNsense 25.1.6_4-amd64
FreeBSD 14.2-RELEASE-p3
OpenSSL 3.0.16