"Recent posts
#1
26.7, 26.10 Series / Re: Changing to Business editi...
Last post by sopex - Today at 03:49:39 PMHahahahaha :)
#2
26.7, 26.10 Series / OPNsense as mail gateway, secu...
Last post by jassonmc - Today at 03:46:35 PMHi everyone,
I have been using OPNsense Business Edition as a mail gateway with the Postfix and Rspamd plugins for quite some time. The setup works well and has been very reliable.
However, I have recently started questioning whether OPNsense is still a suitable platform for running a mail gateway, particularly from a security and long-term maintenance perspective.
My main concern is the maintenance and update cycle of the Postfix and Rspamd packages and their corresponding OPNsense plugins.
Some examples:
Rspamd: Until recently, the OPNsense ports tree was still at version 4.1.0, while upstream had already released 4.2.x, including several security fixes. Fortunately, version 4.2.3 has now been merged into the OPNsense ports tree, which is encouraging.
Postfix: While the Community Edition already provides Postfix 3.11.7, my Business Edition installation (26.4.2p4) still ships with Postfix 3.11.3.
Business vs. Community: The Business Edition follows a different release cycle and appears to lag behind the Community Edition regarding certain package updates. While I understand the benefits of a more conservative release process, this raises questions about the timely distribution of security fixes.
I am aware that the OPNsense plugins and the underlying FreeBSD packages are separate components, and that an unchanged plugin version does not necessarily mean the underlying software is outdated.
Nevertheless, a mail gateway processes untrusted content from the Internet, making timely security updates particularly important.
This raises a few questions:
I am not looking for additional features. My main interest is a reliable, secure and reasonably low-maintenance mail gateway.
I really appreciate the work that goes into OPNsense, and I would prefer to continue using it for this purpose. However, I would like to better understand whether the current maintenance model provides sufficient security coverage for Internet-facing mail services.
I would be particularly interested in feedback from the OPNsense developers and other administrators running Postfix/Rspamd in production.
Thanks for your insights!
I have been using OPNsense Business Edition as a mail gateway with the Postfix and Rspamd plugins for quite some time. The setup works well and has been very reliable.
However, I have recently started questioning whether OPNsense is still a suitable platform for running a mail gateway, particularly from a security and long-term maintenance perspective.
My main concern is the maintenance and update cycle of the Postfix and Rspamd packages and their corresponding OPNsense plugins.
Some examples:
Rspamd: Until recently, the OPNsense ports tree was still at version 4.1.0, while upstream had already released 4.2.x, including several security fixes. Fortunately, version 4.2.3 has now been merged into the OPNsense ports tree, which is encouraging.
Postfix: While the Community Edition already provides Postfix 3.11.7, my Business Edition installation (26.4.2p4) still ships with Postfix 3.11.3.
Business vs. Community: The Business Edition follows a different release cycle and appears to lag behind the Community Edition regarding certain package updates. While I understand the benefits of a more conservative release process, this raises questions about the timely distribution of security fixes.
I am aware that the OPNsense plugins and the underlying FreeBSD packages are separate components, and that an unchanged plugin version does not necessarily mean the underlying software is outdated.
Nevertheless, a mail gateway processes untrusted content from the Internet, making timely security updates particularly important.
This raises a few questions:
- Is OPNsense still actively maintained and recommended as a platform for running a Postfix/Rspamd mail gateway, both in the Community and Business Editions?
- Are security updates for Postfix and Rspamd actively monitored and prioritised, even when the corresponding plugins receive little development activity?
- How does the Business Edition handle security vulnerabilities in packages that are newer in the Community Edition? Are security fixes backported, or do Business users have to wait for the next major release?
- Is there any established maintenance commitment for the Postfix and Rspamd plugins, or do they primarily depend on individual community contributors?
I am not looking for additional features. My main interest is a reliable, secure and reasonably low-maintenance mail gateway.
I really appreciate the work that goes into OPNsense, and I would prefer to continue using it for this purpose. However, I would like to better understand whether the current maintenance model provides sufficient security coverage for Internet-facing mail services.
I would be particularly interested in feedback from the OPNsense developers and other administrators running Postfix/Rspamd in production.
Thanks for your insights!
#3
French - Français / Débloquer un site de salaires ...
Last post by Aldenoah - Today at 03:33:53 PMSalut à tous, petite question du jour mais plutôt un retour d'expérience en fait. On est en pleine période des entretiens annuels ici (PME industrielle du côté de Rennes) et fin novembre la responsable RH débarque dans mon bureau parce qu'elle n'arrive pas à consulter un site de grilles salariales. Chez nous le proxy transparent filtre pas mal de catégories par défaut, histoire d'éviter la navigation non pro, et visiblement ce genre de site tombe dans une catégorie bloquée direct.
Du coup elle m'a transmis l'adresse en question, qui était catégorisé dans le filtre par défaut. J'ai ajouté une règle ACL sur le domaine, rien de bien compliqué, 10 minutes top chrono. Après j'ai vérifié dans les logs d'état que le trafic passait bien et que ça remontait plus en "denied" côté squidguard. Après bon. Ca m'arrive assez régulièrement ce genre de demande ponctuelle, surtout avec des sites un peu limite niveau catégorisation automatique. Vous gérez ça comment de votre côté, exceptions au cas par cas ou vous avez une liste blanche plus large pour les RH?
Du coup elle m'a transmis l'adresse en question, qui était catégorisé dans le filtre par défaut. J'ai ajouté une règle ACL sur le domaine, rien de bien compliqué, 10 minutes top chrono. Après j'ai vérifié dans les logs d'état que le trafic passait bien et que ça remontait plus en "denied" côté squidguard. Après bon. Ca m'arrive assez régulièrement ce genre de demande ponctuelle, surtout avec des sites un peu limite niveau catégorisation automatique. Vous gérez ça comment de votre côté, exceptions au cas par cas ou vous avez une liste blanche plus large pour les RH?
#4
26.7, 26.10 Series / Re: Cert Based WIFI Authentica...
Last post by (MARLOO) - Today at 03:18:06 PMAlso
every Wi-Fi client must support WPA2/WPA3-Enterprise with EAP-TLS and carry its own certificate — otherwise it simply will not connect
Devices without that support (printers, TVs) need a separate WPA2-PSK SSID instead.
every Wi-Fi client must support WPA2/WPA3-Enterprise with EAP-TLS and carry its own certificate — otherwise it simply will not connect
Devices without that support (printers, TVs) need a separate WPA2-PSK SSID instead.
#5
Development and Code Review / Re: netflector available as pl...
Last post by mnaim - Today at 03:05:56 PMAny chance for SSDP via wireguard? Adding peers did not help.
#6
26.7, 26.10 Series / Re: Cert Based WIFI Authentica...
Last post by viragomann - Today at 02:14:08 PMWhat you want to realize is called 802.1X wifi authentication. This requires an authenticator (= wifi access point) and an authentication server (= RADIUS or alike).
You wifi access point has the support this. The feature is also called "WAP2/3 enterprise" on APs.
As auth server you can install the FreeRADIUS plugin on OPNsense. Then you can add a certificate authority and issue the clients certificates from it and assign it in FreeRADIUS for the client verification.
You wifi access point has the support this. The feature is also called "WAP2/3 enterprise" on APs.
As auth server you can install the FreeRADIUS plugin on OPNsense. Then you can add a certificate authority and issue the clients certificates from it and assign it in FreeRADIUS for the client verification.
#7
26.7, 26.10 Series / Re: Changing to Business editi...
Last post by franco - Today at 01:22:02 PMLunch is served it seems. :)
Cheers,
Franco
Cheers,
Franco
#8
Announcements / OPNsense 26.10 business editio...
Last post by franco - Today at 01:19:57 PMThe OPNsense business edition transitions to this 26.10 release including
interface management and gateway groups via MVC/API, wireless MVC/API support,
firewall rules now defaulting to MVC/API, customizable favorites menu, full
screen grids, the OPNDNS plugin as a authoritative nameserver with RFC2136
support, FreeBSD 15.1, OpenSSL 3.5, PHP 8.5 plus much more.
Please make sure to read the migration notes before upgrading.
Download link is as follows. An installation guide[1] and the checksums for
the images can be found below as well.
https://downloads.opnsense.com/
This business release is based on the OPNsense 26.7.7 community version
with additional reliability improvements.
Here are the full patch notes:
o system: remove periodic backups settings and backend code
o system: migrate gateway groups to MVC/API
o system: new service widget flat tile layout (partially contributed by Konstantinos Spartalis)
o system: change our version of "certctl" to emit files instead of links like it is the case in FreeBSD 15.1
o system: include interfaces widget in dashboard default
o system: adjust dashboard widget resize logic to observe border box instead of content box
o system: disable web GUI KTLS use for the time being
o system: use Bootstrap "btn" styles in services widget
o system: fixed several PHP 8.5 warnings
o system: fix default gateway switch alarm trigger being overwritten by gateway group check
o system: use /var/lib/php/tmp in static pages for proper privilege separation
o system: improve "user-config-readonly" in static pages where write_config() was denied
o system: service widget changes based on further community feedback
o system: add redirection capability to SSO provider
o system: truncate long names in services dashboard widget (contributed by circa1665)
o system: handle missing objects during deletion in API (contributed by Julian Pawlowski)
o system: multiple PHP warning fixes (contributed by Julian Pawlowski)
o system: avoid filter_configure() calls to make existing backend call less obscure
o system: add favorites section to menu (contributed by Greelan)
o system: replace cron restart in static PHP pages
o system: normalize output of get_nameservers()
o system: flush volt template cache in shared action
o system: add pfsync version 1500 to HA settings (contributed by Bjoern Jakobsen)
o system: add hidden services so they can be operated by pluginctl -s
o system: privilege separated reload in static PHP pages
o system: lower priority of automatic wg/ipsec gateways
o system: fix disk widget loading issue (contributed by Konstantinos Spartalis)
o system: change diag.disk to return total bytes as well as formatted bytes
o system: add webgui PAM config to test with opnsense-login
o system: switch password hashing from bcrypt to argon2id
o system: reject a null gateway in getGatewayAction()
o system: add "latency_avg" as sanity check for running dpinger
o system: missing chown in backup call for proper non-root web GUI access
o system: do not allow system scope users to be renamed
o system: fix output of pw usershow
o system: run file and configuration selfchecks during bootup
o system: add service broker flag for remote handling of Kea
o system: mark "X509v3 Key Usage" critical for certificate creation
o system: installer as a real user on demand
o reporting: migrate several settings pages to MVC/API and assorted changes
o reporting: correctly map NetFlow indexes when there are gaps (contributed by Thomas Cheyney)
o reporting: make parsing iftop lines more robust for traffic graphs (contributed by Brendan Bank)
o reporting: map ARC and laundry to cache memory stats (contributed by Konstantinos Spartalis)
o reporting: unbound: add DNSSEC status column in details grid
o interfaces: migrate interface assignments to MVC/API
o interfaces: fix faulty netmask on loopback address due to upstream change
o interfaces: fix assignment of wireless devices
o interfaces: strict description fields in new assignments page[2] (reported by call-AX)
o interfaces: add "noclamp" flag for GIF
o interfaces: add separate link types for IPv4 and IPv6 in overview
o interfaces: return the proper UUID when assigning an interface (contributed by Kemoy Campbell)
o interfaces: permit a VLAN device as bridge member
o interfaces: resolve VLAN devices indirectly via interfaces_configure()
o interfaces: handle missing GRE and GIF during deletion in API (contributed by Julian Pawlowski)
o interfaces: multiple PHP warning fixes (contributed by Julian Pawlowski)
o interfaces: emit discovered hosts sorted by last_seen via hostwatch
o interfaces: add missing PPP support to interface_parent_devices()
o interfaces: prevent inline reloads of VLANs via rc.linkup
o interfaces: batch VIP post-reload for proxyarp/pfsync
o interfaces: exclude VLAN devices from virtual queue
o interfaces: migrate wireless configuration to MVC/API
o interfaces: return an empty string which cannot be an interface in convert_real_interface_to_friendly_interface_name()
o interfaces: provide "uuid" in legacy_config_get_interfaces()
o interfaces: split media and mediaopt with tabs instead of spaces
o interfaces: a few config_read_array() replacements
o interfaces: refactor device matching around interface_parent_devices()
o interfaces: remove cua matching from PPP device pattern
o interfaces: refactor interfaces_loopback_configure() and add ::1/128 sync
o interfaces: fix PHP warnings in interfaces.php and do not write unset options
o interfaces: refactor interfaces_ppps_hardware() and avoid emitting serial device nodes
o interfaces: allow to push $all_plugins in interface_configure()
o interfaces: retire problematic validations in interface settings pertaining to legacy ISC-DHCP plugin
o interfaces: split out interfaces_dependencies() and make it digestible via pluginctl -Q
o interfaces: add interface configuration settings in new assignments page
o interfaces: prevent interface_configure() from reloading non-interface hooks when in batch mode
o interfaces: improve queue build sequence in interfaces_dependencies()
o interfaces: remove stale VIP address after update (contributed by ExpRam)
o interfaces: be more conservative with -no_dad
o interfaces: add a new "updateip" hook
o interfaces: PPP type validation fixes for new assignments
o interfaces: add missing validation for "configurable" and "spoofmac" in new settings API
o interfaces: only store "dhcp6_norequest_dns" in DHCPv6 mode in new settings API
o interfaces: only store "track6-interface" in ID association / Track interface modes in new settings API
o interfaces: do not render "none" to configuration in new settings API
o interfaces: move promiscuous mode to advanced in new settings API
o interfaces: fix index into $todo for proper flag check during apply in new settings API
o interfaces: provide better option group labels to DeviceField
o interfaces: add proper local/remote IP support to PPPoE IPCP
o interfaces: move legacy apply cache to /var/lib/php/tmp
o interfaces: blank description "None" is the default
o interfaces: fix handling of prefix delegation size on new assignment page
o firewall: move config.xml default LAN allow rules to new rules GUI
o firewall: legacy rules pages move to plugin
o firewall: restrict automatic DHCPv6 filter rules to plugin/track6 use
o firewall: always set a sequence at the end of the rule set when cloning a NAT rule
o firewall: remove unused "safepoint" actions
o firewall: fix automatic source NAT rules not displayed for PPPoE interfaces
o firewall: flatten automatic source NAT rules into two per WAN type interface
o firewall: prevent deletion if a group is referenced in MVC rules
o firewall: use proper path for one-to-one NAT rules for renaming operations
o firewall: avoid emitting reply-to on block rules as well
o firewall: change interface group render/apply order
o firewall: adjust MVC alias rename according to address_to_pconfig()
o firewall: adapt getAdvancedIds() to the sectioned form structure
o firewall: skip message banner if searchPhrase set
o firewall: fix PHP warning when scrub yields no interfaces
o firewall: group invalid rules to the end of the ruleset
o firewall: enable virtualDOM and refactor commands on alias page
o firewall: add "endpoint-independent" support for UDP translations (full cone NAT) in source NAT
o firewall: fix missing well-known ports in local-port in destination NAT
o firewall: add "max-pkt-rate" rate limiting option to firewall rules
o firewall: add proper support for container items in search field selection, export and import data and implement it in destination NAT
o firewall: deprecate old rule register function names due to functional overlaps
o firewall: add missing TLS ports to well-known ports (contributed by Self-Hosting-Group)
o firewall: use new "rlabel" from pfctl for persistent rule identification across reloads
o firewall: emit gateway debug message in block rules only when gateway is not empty
o firewall: aliases: use same dynamic label as in KEA DHCPv6 for a unified look
o firewall: aliases: fix spinner on alias dialog save button
o firewall: destination NAT: make local-port numeric before applying range in registered firewall rule (contributed by Thomas Cheyney)
o firewall: rules: add "received-on" interface keyword as interface origin option
o firewall: rules: promote "statetype" from advanced to common option for "received-on" usage
o firewall: source NAT: fix faulty import removal
o firewall: source NAT: add pool options and source hash key
o firewall: source NAT: fix port alias and well known port usage in target_port
o firewall: make source and destination NAT automatic rules visible in GUI
o firewall: implement JsonAuditField in all MVC components
o firewall: update the internally reserved pf keywords for FreeBSD 15
o firewall: add source NAT migration banner to outbound NAT
o firewall: add private network exclusions to default IPv6 bogons (contributed by Maurice Walker)
o firewall: outbound NAT moves to legacy plugin
o firewall: remove handling loopback addresses as "private"
o firewall: use font-awesome elements for data tree controls to align with themes
o firewall: aliases: reject reversed port ranges
o firewall: destination NAT: fix destination for no-rdr rules (reported by fa1k3)
o firewall: destination NAT: add safety guards for calculated port ranges
o firewall: fix off by one in addAction() in alias diagnostics
o firewall: destination NAT: fix typo in parseRdrRules() causing faulty rules not being disabled
o firewall: aliases: validate that port aliases always have content
o firewall: revert a clone rule change so that cloned rules to appear adjacent to the original rule again
o firmware: opnsense-update: replace known variables instead of using eval[3] (reported by Voidlet)
o firmware: opnsense-code: some improvements with regard to core upgrades
o firmware: opnsense-bootstrap: fix bootstrap on FreeBSD 15 with pkgbase
o firmware: opnsense-prefetch: new tool for sets prefetching
o firmware: opnsense-sign: shell compatibility update
o firmware: adjust the incompatible pkg test
o firmware: disable FreeBSD-base repository and remove old definitions
o firmware: opnsense-patch: added -R mode and updated -N mode
o firmware: opnsense-prefetch: get remote size and print mismatches
o firmware: opnsense-prefetch: curl use is now optional
o firmware: add simple prompt to console changelog viewer
o firmware: tighten validation for mirror URL (reported by Abraxas Labs)
o firmware: revoke 26.1 fingerprint
o captive portal: move template actions out of the ServiceController into its own TemplateController
o captive portal: adjust accounting interval to Acct-Interim-Interval
o dhcrelay: add options for circuit_id and remote_id (contributed by Thomas Cheyney)
o dnsmasq: possible use before define in lease watcher
o dnsmasq: remove count badge from GroupBy with static configuration elements
o dnsmasq: add "expand-hosts" option (contributed by Konstantinos Spartalis)
o dnsmasq: leases sorting fixes (contributed by Greelan)
o intrusion detection: rename "uncategorized" rule package to "adult" (contributed by Konstantinos Spartalis)
o intrusion detection: fix displaying URL in descriptions (contributed by Konstantinos Spartalis)
o intrusion detection: always initialize reference_html (reported by Adam Korczynski of Ada Logics using Anrophic)
o ipsec: add "replay_window" option to children
o kea: remove count badge from GroupBy with static configuration elements
o kea: use DOM construction for the "dynamic" label
o kea: fix leases sorting (contributed by Greelan)
o kea: add ping check settings for subnet configuration (contributed by laozhoubuluo)
o kea: add setup.sh to create /var/log/kea before use
o monit: use LIBXML_NOCDATA on XML fetch
o monit: change "logfile" to "log" to fix syntax on newer daemon
o monit: log from the first line and reconfigure through the base class (contributed by IvanTheGeek)
o network time: strict security GUI support
o openvpn: moved legacy CARP hook to os-openvpn-legacy plugin
o openvpn: default keepalive to "10 60" in server mode and improve validation
o wireguard: add allowed-ips to reresolve-dns.py in case none are set yet
o wireguard: FreeBSD 15 no longer allows addresses without netmasks
o wireguard: cleaner QR codes (contributed by Roy Orbitson)
o wireguard: preserve peer generator state for existing peers
o acl: merge user management ACLs into one single privilege
o acl: fix patterns for gateway groups (contributed by Andrew Ferk)
o backend: allow "strict" mode +TARGETS using the preamble "!"
o backend: sanitize template filename replacements
o backend: further restrict actions to root and wwwonly for more sensitive actions
o backend: ensure strict templates are not reloaded via "*" wildcard
o backend: add CLOEXEC to a few file descriptor opens to avoid lock inheritance
o bootgrid: exclude header cells from status color rendering
o bootgrid: upgrade Tabulator to version 6.5.3
o mvc: refactor base_dialog and parseFormNode() to simplify the template
o mvc: remove unused argument from getFormGrid()
o mvc: BaseField: emit descriptions in getNodes() when they are not the same as the value to match getNodeContent()
o mvc: BaseField: add getInitialValue()
o mvc: BaseField: add getDefault() and isDefault() for future use
o mvc: PortField: reject whitespaces in port ranges during validation
o mvc: ModelRelationField: remove grouped option handling
o mvc: add file type to forms
o mvc: fix tab/subtab form generation for plugins
o mvc: fix default labels in selectpickers
o mvc: create runInterfaceRegistation() and use it for immediate device registration
o mvc: add some exception types and handle them in the base template
o mvc: clean up a number of stale imports
o mvc: OptionField: fix simplified option group definition
o mvc: fix typo in base_form.volt advanced/help toggle IDs
o mvc: fix assorted stale imports in the code base
o mvc: advanced marker for form/dialog fields
o mvc: fix stale imports for Message classes
o mvc: JsonAduditField: shared implementation for configuration revision tracking
o mvc: guard direct config saves against user-config-readonly (contributed by Andrew Ferk)
o mvc: disable Nginx reverse proxy buffering on configd streams
o mvc: dispatch failed message during reconfiguredAction()
o mvc: PortField: keep the first well-known service in the option list (contributed by fa1k3)
o mvc: PortField: always return a string for normalizedPort()
o mvc: UidField: allow an arbitrarily specified UID for system scope users upon creation
o mvc: UidField: revert "allow an arbitrarily specified UID for system scope users upon creation"
o mvc: UidField: add isolated updateValue() for installer user
o ui: add "opnsense-auto" theme which switches between "opnsense" and "opnsense-dark" depending on browser setting
o ui: decrease flashing in opnsense-auto theme when switching (contributed by Konstantinos Spartalis)
o ui: remove direct apply_btn_id usage in favour of base_apply_button template partial
o ui: fix menu registration not setting "active"
o ui: add tokenize2.css in standard theme to ensure selection in opnsense-auto theme
o ui: prevent blinking by hiding the contents while loading for opnsense-auto theme
o ui: fix collapsed sidebar stray line and restore rail divider in opnsense-dark theme (contributed by circa1665)
o ui: restore stacked layout for interfaces widget on narrow (contributed by circa1665)
o ui: fix minor JavaScript bugs in dashboard widget code (contributed by Thomas Schöpf)
o ui: do not freeze commands column on touchscreen devices
o ui: further fixes for base templates
o ui: fix empty legacy firewall menu container glitch
o ui: bootgrid: classname can depend on state, accept a callback function
o ui: tabulator: add _showMaximized() modal that can show a grid close to full screen
o ui: add keyboard shortcut "f" to maximize a currently visible grid
o ui: scope "all help" and "advanced mode" toggle to closest relevant form
o ui: trigger "h" and "a" keyboard shortcuts on all relevant matches
o ui: improve form matching for help/advanced
o ui: fix _showMaximized() height calculation when mobile navigation triggers below 768px width
o ui: attach selectors piped through replaceInputWithSelector to body
o ui: fix widget bottom gap in standard theme files (contributed by Konstantinos Spartalis)
o ui: sidebar fixes and rework (contributed by Team Rebellion)
o ui: remove spurious _formDialog portion of dialog IDs
o ui: implement dialog search field
o ui: ensure a minimum amount of rows to render in grids
o ui: only schedule grid dimension changes after data processing, window resizing and table visibility changes
o ui: remove defunct content-box-main usage
o ui: make settings-changed trigger overridable
o ui: fix blank bottom UI space (contributed by Konstantinos Spartalis)
o ui: do not add the spinner again when it fails
o ui: bootgrid: sync columnselect-input state with (un)setColumns
o ui: sync expanded state for selected submenus
o ui: close mobile menu when a menu entry opens another tab of the current page (contributed by Greelan)
o plugins: add error returns to plugins_configure()
o plugins: OPNBEcore 1.10
o plugins: OPNWAF 2.6
o plugins: OPNcentral 1.13
o plugins: os-acme-client 4.17[4]
o plugins: os-caddy 2.2.1[5]
o plugins: os-ddclient 1.33[6]
o plugins: os-firewall-legacy 1.1 contains the static PHP firewall rules pages[7]
o plugins: os-frr 2.0[8]
o plugins: os-intrusion-detection-content-at-antiphishing 1.0[9] (contributed by Julio Lira)
o plugins: os-iperf 2.0[10]
o plugins: os-ndp-proxy-go 1.5[11]
o plugins: os-ndproxy has been removed, use os-ndp-proxy-go instead
o plugins: os-net-snmp 1.7[12]
o plugins: os-nrpe 1.2[13]
o plugins: os-puppet-agent 2.0[14]
o plugins: os-sftp-backup 1.2 verify backups after put
o plugins: os-theme-cicada 1.42 (contributed by Greelan)
o plugins: os-theme-rebellion 1.9.8 (contributed by Team Rebellion)
o plugins: os-theme-tukan 1.32 (contributed by Team Rebellion)
o plugins: os-theme-vicuna 1.52 (contributed by Team Rebellion)
o plugins: os-turnserver 1.4[15]
o src: FreeBSD 15.1-RELEASE-p6 plus assorted stable/15 networking commits[16]
o src: pf: do not mangle IP header before shared forwarding
o src: pf: stop resolving hosts via DNS that use ":" modifier
o src: pf: clear anchor after stepping into it in pf_match_translation_rule()
o src: pf: pf_route() "dst" no longer holds the gateway in 15.x
o src: pf: add missing PF_TS_CNT netlink attribute
o src: pf: expose first rule label for states since rule number is insufficient
o src: usb: bpfattach() before if_attach()
o src: ena: update driver version to v2.8.4
o src: assorted minor commits from stable/15
o src: jail: restore ktrace privileges for jailed root[17]
o src: ktimer: check for errors from realtimer_gettime()[18]
o src: kqueue: avoid enqueuing an already-enqueued knote[19]
o src: zfs: multiple fixes[20]
o src: revert "daemon: replace memchr with memrchr"
o src: cred: fix group_is_primary()[21]
o src: unix: fix some bugs in the SOCK_STREAM receive path[22]
o src: netmap: fix driver name handling
o src: netmap: fix a race in kqueue registration
o src: e1000: assorted upstream patches from stable/15
o src: iflib: support recoverable initialization failure
o src: route: add an eventhandler for rt_numfibs changes
o src: rawip: fix handling of checksums in rip6_input()
o src: pf: attempt to handle overlapping group and interface names
o src: pf: check if a group has a kif before dereferencing it
o src: pf: fix fallout from the STATE_LOOKUP macro removal
o src: pf: re-optimize state key handling
o src: pf: rule label patch was merged from a wrong version
o src: pfsync: handle large MTU pfsync interfaces
o src: ktls: propagate EPG_FLAG_ANON to mapped mbufs
o src: netipsec: fix sockaddr type set in ipcomp6_nonexp_encapcheck()
o src: PF_KEY socket: limit the length of copied socket address
o src: ure: add USB device IDs for additional RTL8152/RTL8153 adapters
o src: ure: fix spurious link flaps from MII
o src: ciss: revert patch that added max physical target
o src: pf: do not set a null rule pointer during test
o src: pf: fix securelevel off-by-one
o src: pfctl: fix printing of wildcard anchors
o src: e1000: more assorted upstream patches from stable/15
o src: ixgbe: assorted upstream patches from stable/15
o src: virtio_p9fs: disallow detach if a session is in progress
o src: route/fib_algo: free leaked radix_masks in radix_lockless
o src: netipsec: implement pr_disconnect for PF_KEY sockets
o src: iflib: assorted upstream patches from stable/15
o src: net: add ifmedia support for 10GBase-BX BiDi
o src: bnxt: report initialization failures to iflib
o src: bnxt: add led(4) identification support
o src: ice: add led(4) identification support
o src: ice: report initialization failures to iflib
o src: ice: add support for E835 CNSA 2.0 adapters
o src: ice: add two more 4-part IDs for E835 adapters
o src: if_vxlan: fix panic by validating unused drvspec values
o src: qat: driver updates to enhance qat infrastructure
o src: ath10k: remove some early FreeBSD-specific debugging
o src: ip(6)_mroute: assorted upstream patches from stable/15
o src: in_mcast: fix uninitialized variable usage in inm_merge()
o src: bind: lookup local address in current FIB if "*.bind_all_fibs" is active
o src: net: add fib-aware ifa_ifwithaddr()
o src: kqueue: memory safety bugs in kqueue copy-on-fork implementation[23]
o src: syslogd: fix leaking child processes when logging to a pipe[24]
o src: iflib: do not hold the ifnet lock across registration
o src: ixgbe: correct Wake-on-LAN configuration
o src: dummynet: do not overflow the points[ED_MAX_SAMPLES_NO] array
o src: pf: mark non-port packets to require IP checksumming
o src: pf: set the correct type for rule timeouts
o src: loopback: improve checksum offloading
o src: vlan: use the exclusive lock everywhere
o src: raw ip: clear sin_port on bind(2)
o src: nd6: fix regeneration of temp addresses in detached state
o src: hyperv: fix single page invalidation path
o src: route/fib_algo: fix nexthop index collision across families
o src: ice: do not leave device non-functional if Tx scheduler config fails
o src: netipsec: fix V_spd_size updates
o src: bnxt: assorted updates from stable/15
o src: ixl: assorted updates from stable/15
o src: linxkpi: assorted updates from stable/15
o src: net80211: assorted updates from stable/15
o src: pci: assorted updates from stable/15
o src: pf: send syncookies from the receiving thread
o src: hyperv: fix two regressions in previous upstream patch
o src: pcib: only apply ARI translation to the own secondary bus of a bridge
o src: ktls CBC decrypt: avoid creating zero length iovec entries
o src: route/fib_algo: respect immediate_sync in fd_ref_nhop
o src: route/fib_algo: fix FIB_ALGO without ROUTE_MPATH option
o src: sysctl: retire SYSCTL_NODE_CHILDREN()
o src: caroot: TLS certificate store update due to eMudhra compromise[25]
o src: bhyve: multiple vulnerabilities in bhyve device models[26]
o src: sound: TOCTOU race between sound(4) buffer resizing and mmap[27]
o src: tcp: remotely triggerable buffer overflow in tcp_rack[28]
o src: tcp: TCP timers may overflow and fire late or not at all[29]
o src: hastd: multiple issues in hastd(8)[30]
o src: tzdata: import tzdata 2026e[31]
o ports: ca_root_nss / nss 3.132[32]
o ports: curl 8.23.0[33]
o ports: dhcp6c fix for truncated env vars in dhcp6c-script (contributed by Michael Zimmermann)
o ports: dpinger 3.6
o ports: expat 2.8.5[34]
o ports: filterlog 0.9 support for pflog actions on FreeBSD 15
o ports: hostapd / wpa_supplicant 2.12
o ports: kea 3.0.4[35]
o ports: libevent 2.1.13[36]
o ports: libxml 2.15.4[37]
o ports: lighttpd 1.4.85[38]
o ports: monit 6.0.0[39]
o ports: openldap 2.6.15[40]
o ports: openssl 3.5.9[41]
o ports: pcre2 10.49[42]
o ports: pecl-mcrypt 1.0.9
o ports: perl 5.42.3[43]
o ports: phalcon 5.22.1[44]
o ports: php 8.5.12[45]
o ports: phpseclib 3.0.57[46]
o ports: pkg 2.8.4
o ports: py-duckdb 1.5.6[47]
o ports: rrdtool 1.11.0[48]
o ports: sqlite 3.53.4[49]
o ports: unbound 1.26.2[50]
Migration notes, known issues and limitations:
o The privileges "page-system-groupmanager" and "page-system-usermanager-addprivs" were merged into "page-system-groupmanager" and are no longer available separately. This was done to avoid the misconception that access to a user management page gives constrained rights to each page, but that is not the case. User management is a process involving all 3 pages.
o The static PHP pages for firewall rule and outbound NAT management have been moved to the "os-firewall-legacy" plugin which can be manually installed before or after the upgrade. All rules will continue to work regardless of the plugin being installed or not and are easily migrated using the given assistant.
o Since this is a major OS upgrade and OpenSSL changes from 3.0 to 3.5 third party repositories may interfere with your upgrade experience. Removing offending repositories and plugins may help; or wait for affirmation from the respective repository owners.
o The CPU microcode early loading has been known to be flaky on some setups. A fix is in the FreeBSD 15.1 boot loader code, but can only be reached by reinstall or manually updating the boot code of your system after the upgrade succeeded. If you want to be on the safe side during the upgrade itself please remove the plugin before proceeding.
The public key for the 26.10 series is:
-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAziSNKuzrL2cwLx5LXmLn
cWS5Lk+i9CzRMXO/4xQYBQCaSnd8GBg/HA/g4aPoTUa6ovAI0AHfW8KQJQyBkFzn
pi6MLZJ9tEaFcn0CiV+tSTJd1RV4bB8jtpKl5oTkgFrPsyaB7iBlG5Cd49VCW19h
DxClQ24lkWkVoYfsfCQEt4ADNGLygWCPyf4bxGD/t6/tiW9SsOs2+gfOZ9C/G2d/
EBhJFoBEoz5lvULVxTdfY5PScYrHD/waZnk3rGc2A+9pI/SM2JAwKqsgZ6MSFbXO
DNocSjqFUUkdqhty+Qcc0OJ+hMbKKVE+f3QJBQIwT3ayys8QK0m5CCo91/f+DjoN
noj+t5YN9x8GREkF0wrdIi7hevkwrL2/SJQbq1bL1BLB+mMSXYR611lgT8YfYjyZ
7tmpNVC3O5Pj7l20snm1lVUSqS0PsFBvh6HQtBRwQDGppaIIhH1Nt9yIatmSiGZt
2YrMVNBzbQrJzSX+vWcAulkaPIt4t+XxmpO5IDNZ+4uMZ7XyJq1lAhIeyXx+Falf
v7S+ZpJWFVNz0/N5z6lBbADD855i+gFY6B5209xGyhd6FwaPOjISgQKkgBwF1AiW
MDuTuP9lkh/U5gGBZIFTnbdEMgOAL4P+Hsw9Nozav+3QIpiU3Pv9F29a1erCkq09
rpQyNglY7Jqme/RipzbYia8CAwEAAQ==
-----END PUBLIC KEY-----
Stay safe,
Your OPNsense team
--
SHA256 (OPNsense-business-26.10-dvd-amd64.iso.bz2) = e746a1a817480fd2c432611d399a7e3e49d6c35e70c748b4d56fb0c30ff892d9
SHA256 (OPNsense-business-26.10-nano-amd64.img.bz2) = 25bd59e97da0ca5bd345ee4c162560dfe012bdf1c0e197dccdd0a59211080ebb
SHA256 (OPNsense-business-26.10-serial-amd64.img.bz2) = 270c26642c5e2bc27d23fd359c68d0235fae3e7a5b5e3bdae2076bddc8d3f887
SHA256 (OPNsense-business-26.10-vga-amd64.img.bz2) = 259c64cf20e3224224afe702697dfc28a8ab6ee98a0704b201c3b0b8105ac8dc
[1] https://docs.opnsense.org/manual/install.html
[2] https://github.com/opnsense/core/security/advisories/GHSA-9h93-hhcx-957c
[3] https://github.com/opnsense/core/security/advisories/GHSA-p683-f7x2-pm4p
[4] https://github.com/opnsense/plugins/blob/stable/26.7/security/acme-client/pkg-descr
[5] https://github.com/opnsense/plugins/blob/stable/26.7/www/caddy/pkg-descr
[6] https://github.com/opnsense/plugins/blob/stable/26.7/dns/ddclient/pkg-descr
[7] https://github.com/opnsense/plugins/blob/stable/26.7/net/firewall-legacy/pkg-descr
[8] https://github.com/opnsense/plugins/blob/stable/26.7/net/frr/pkg-descr
[9] https://julioliraup.github.io/AT/
[10] https://github.com/opnsense/plugins/blob/stable/26.7/benchmarks/iperf/pkg-descr
[11] https://github.com/opnsense/plugins/blob/stable/26.7/net/ndp-proxy-go/pkg-descr
[12] https://github.com/opnsense/plugins/blob/stable/26.7/net-mgmt/net-snmp/pkg-descr
[13] https://github.com/opnsense/plugins/blob/stable/26.7/net-mgmt/nrpe/pkg-descr
[14] https://github.com/opnsense/plugins/blob/stable/26.7/sysutils/puppet-agent/pkg-descr
[15] https://github.com/opnsense/plugins/blob/stable/26.7/net/turnserver/pkg-descr
[16] https://www.freebsd.org/releases/15.1R/relnotes/
[17] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:53.ktrace.asc
[18] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:51.ktimer.asc
[19] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:50.kqueue.asc
[20] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:19.zfs.asc
[21] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:59.mac_do.asc
[22] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:57.unix.asc
[23] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:65.kqueue.asc
[24] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:23.syslogd.asc
[25] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:73.caroot.asc
[26] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:72.bhyve.asc
[27] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:71.sound.asc
[28] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:70.tcp.asc
[29] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:27.tcp.asc
[30] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:26.hastd.asc
[31] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:25.tzdata.asc
[32] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_132.html
[33] https://curl.se/changes.html#8_23_0
[34] https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/Changes
[35] https://gitlab.isc.org/isc-projects/kea/-/wikis/Release-Notes/release-notes-3.0.4
[36] https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
[37] https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.15.4/NEWS
[38] https://www.lighttpd.net/2026/07/08/1.4.85/
[39] https://mmonit.com/monit/changes/
[40] https://www.openldap.org/software/release/changes_lts.html
[41] https://github.com/openssl/openssl/blob/openssl-3.0/CHANGES.md
[42] https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.49
[43] https://perldoc.perl.org/5.42.3/perldelta
[44] https://github.com/phalcon/cphalcon/releases/tag/v5.22.1
[45] https://www.php.net/ChangeLog-8.php#8.5.9
[46] https://github.com/phpseclib/phpseclib/releases/tag/3.0.57
[47] https://github.com/duckdb/duckdb/releases/tag/v1.5.6
[48] https://github.com/oetiker/rrdtool-1.x/releases/tag/v1.11.0
[49] https://sqlite.org/releaselog/3_53_4.html
[50] https://nlnetlabs.nl/projects/unbound/download/#unbound-1-26-2
interface management and gateway groups via MVC/API, wireless MVC/API support,
firewall rules now defaulting to MVC/API, customizable favorites menu, full
screen grids, the OPNDNS plugin as a authoritative nameserver with RFC2136
support, FreeBSD 15.1, OpenSSL 3.5, PHP 8.5 plus much more.
Please make sure to read the migration notes before upgrading.
Download link is as follows. An installation guide[1] and the checksums for
the images can be found below as well.
https://downloads.opnsense.com/
This business release is based on the OPNsense 26.7.7 community version
with additional reliability improvements.
Here are the full patch notes:
o system: remove periodic backups settings and backend code
o system: migrate gateway groups to MVC/API
o system: new service widget flat tile layout (partially contributed by Konstantinos Spartalis)
o system: change our version of "certctl" to emit files instead of links like it is the case in FreeBSD 15.1
o system: include interfaces widget in dashboard default
o system: adjust dashboard widget resize logic to observe border box instead of content box
o system: disable web GUI KTLS use for the time being
o system: use Bootstrap "btn" styles in services widget
o system: fixed several PHP 8.5 warnings
o system: fix default gateway switch alarm trigger being overwritten by gateway group check
o system: use /var/lib/php/tmp in static pages for proper privilege separation
o system: improve "user-config-readonly" in static pages where write_config() was denied
o system: service widget changes based on further community feedback
o system: add redirection capability to SSO provider
o system: truncate long names in services dashboard widget (contributed by circa1665)
o system: handle missing objects during deletion in API (contributed by Julian Pawlowski)
o system: multiple PHP warning fixes (contributed by Julian Pawlowski)
o system: avoid filter_configure() calls to make existing backend call less obscure
o system: add favorites section to menu (contributed by Greelan)
o system: replace cron restart in static PHP pages
o system: normalize output of get_nameservers()
o system: flush volt template cache in shared action
o system: add pfsync version 1500 to HA settings (contributed by Bjoern Jakobsen)
o system: add hidden services so they can be operated by pluginctl -s
o system: privilege separated reload in static PHP pages
o system: lower priority of automatic wg/ipsec gateways
o system: fix disk widget loading issue (contributed by Konstantinos Spartalis)
o system: change diag.disk to return total bytes as well as formatted bytes
o system: add webgui PAM config to test with opnsense-login
o system: switch password hashing from bcrypt to argon2id
o system: reject a null gateway in getGatewayAction()
o system: add "latency_avg" as sanity check for running dpinger
o system: missing chown in backup call for proper non-root web GUI access
o system: do not allow system scope users to be renamed
o system: fix output of pw usershow
o system: run file and configuration selfchecks during bootup
o system: add service broker flag for remote handling of Kea
o system: mark "X509v3 Key Usage" critical for certificate creation
o system: installer as a real user on demand
o reporting: migrate several settings pages to MVC/API and assorted changes
o reporting: correctly map NetFlow indexes when there are gaps (contributed by Thomas Cheyney)
o reporting: make parsing iftop lines more robust for traffic graphs (contributed by Brendan Bank)
o reporting: map ARC and laundry to cache memory stats (contributed by Konstantinos Spartalis)
o reporting: unbound: add DNSSEC status column in details grid
o interfaces: migrate interface assignments to MVC/API
o interfaces: fix faulty netmask on loopback address due to upstream change
o interfaces: fix assignment of wireless devices
o interfaces: strict description fields in new assignments page[2] (reported by call-AX)
o interfaces: add "noclamp" flag for GIF
o interfaces: add separate link types for IPv4 and IPv6 in overview
o interfaces: return the proper UUID when assigning an interface (contributed by Kemoy Campbell)
o interfaces: permit a VLAN device as bridge member
o interfaces: resolve VLAN devices indirectly via interfaces_configure()
o interfaces: handle missing GRE and GIF during deletion in API (contributed by Julian Pawlowski)
o interfaces: multiple PHP warning fixes (contributed by Julian Pawlowski)
o interfaces: emit discovered hosts sorted by last_seen via hostwatch
o interfaces: add missing PPP support to interface_parent_devices()
o interfaces: prevent inline reloads of VLANs via rc.linkup
o interfaces: batch VIP post-reload for proxyarp/pfsync
o interfaces: exclude VLAN devices from virtual queue
o interfaces: migrate wireless configuration to MVC/API
o interfaces: return an empty string which cannot be an interface in convert_real_interface_to_friendly_interface_name()
o interfaces: provide "uuid" in legacy_config_get_interfaces()
o interfaces: split media and mediaopt with tabs instead of spaces
o interfaces: a few config_read_array() replacements
o interfaces: refactor device matching around interface_parent_devices()
o interfaces: remove cua matching from PPP device pattern
o interfaces: refactor interfaces_loopback_configure() and add ::1/128 sync
o interfaces: fix PHP warnings in interfaces.php and do not write unset options
o interfaces: refactor interfaces_ppps_hardware() and avoid emitting serial device nodes
o interfaces: allow to push $all_plugins in interface_configure()
o interfaces: retire problematic validations in interface settings pertaining to legacy ISC-DHCP plugin
o interfaces: split out interfaces_dependencies() and make it digestible via pluginctl -Q
o interfaces: add interface configuration settings in new assignments page
o interfaces: prevent interface_configure() from reloading non-interface hooks when in batch mode
o interfaces: improve queue build sequence in interfaces_dependencies()
o interfaces: remove stale VIP address after update (contributed by ExpRam)
o interfaces: be more conservative with -no_dad
o interfaces: add a new "updateip" hook
o interfaces: PPP type validation fixes for new assignments
o interfaces: add missing validation for "configurable" and "spoofmac" in new settings API
o interfaces: only store "dhcp6_norequest_dns" in DHCPv6 mode in new settings API
o interfaces: only store "track6-interface" in ID association / Track interface modes in new settings API
o interfaces: do not render "none" to configuration in new settings API
o interfaces: move promiscuous mode to advanced in new settings API
o interfaces: fix index into $todo for proper flag check during apply in new settings API
o interfaces: provide better option group labels to DeviceField
o interfaces: add proper local/remote IP support to PPPoE IPCP
o interfaces: move legacy apply cache to /var/lib/php/tmp
o interfaces: blank description "None" is the default
o interfaces: fix handling of prefix delegation size on new assignment page
o firewall: move config.xml default LAN allow rules to new rules GUI
o firewall: legacy rules pages move to plugin
o firewall: restrict automatic DHCPv6 filter rules to plugin/track6 use
o firewall: always set a sequence at the end of the rule set when cloning a NAT rule
o firewall: remove unused "safepoint" actions
o firewall: fix automatic source NAT rules not displayed for PPPoE interfaces
o firewall: flatten automatic source NAT rules into two per WAN type interface
o firewall: prevent deletion if a group is referenced in MVC rules
o firewall: use proper path for one-to-one NAT rules for renaming operations
o firewall: avoid emitting reply-to on block rules as well
o firewall: change interface group render/apply order
o firewall: adjust MVC alias rename according to address_to_pconfig()
o firewall: adapt getAdvancedIds() to the sectioned form structure
o firewall: skip message banner if searchPhrase set
o firewall: fix PHP warning when scrub yields no interfaces
o firewall: group invalid rules to the end of the ruleset
o firewall: enable virtualDOM and refactor commands on alias page
o firewall: add "endpoint-independent" support for UDP translations (full cone NAT) in source NAT
o firewall: fix missing well-known ports in local-port in destination NAT
o firewall: add "max-pkt-rate" rate limiting option to firewall rules
o firewall: add proper support for container items in search field selection, export and import data and implement it in destination NAT
o firewall: deprecate old rule register function names due to functional overlaps
o firewall: add missing TLS ports to well-known ports (contributed by Self-Hosting-Group)
o firewall: use new "rlabel" from pfctl for persistent rule identification across reloads
o firewall: emit gateway debug message in block rules only when gateway is not empty
o firewall: aliases: use same dynamic label as in KEA DHCPv6 for a unified look
o firewall: aliases: fix spinner on alias dialog save button
o firewall: destination NAT: make local-port numeric before applying range in registered firewall rule (contributed by Thomas Cheyney)
o firewall: rules: add "received-on" interface keyword as interface origin option
o firewall: rules: promote "statetype" from advanced to common option for "received-on" usage
o firewall: source NAT: fix faulty import removal
o firewall: source NAT: add pool options and source hash key
o firewall: source NAT: fix port alias and well known port usage in target_port
o firewall: make source and destination NAT automatic rules visible in GUI
o firewall: implement JsonAuditField in all MVC components
o firewall: update the internally reserved pf keywords for FreeBSD 15
o firewall: add source NAT migration banner to outbound NAT
o firewall: add private network exclusions to default IPv6 bogons (contributed by Maurice Walker)
o firewall: outbound NAT moves to legacy plugin
o firewall: remove handling loopback addresses as "private"
o firewall: use font-awesome elements for data tree controls to align with themes
o firewall: aliases: reject reversed port ranges
o firewall: destination NAT: fix destination for no-rdr rules (reported by fa1k3)
o firewall: destination NAT: add safety guards for calculated port ranges
o firewall: fix off by one in addAction() in alias diagnostics
o firewall: destination NAT: fix typo in parseRdrRules() causing faulty rules not being disabled
o firewall: aliases: validate that port aliases always have content
o firewall: revert a clone rule change so that cloned rules to appear adjacent to the original rule again
o firmware: opnsense-update: replace known variables instead of using eval[3] (reported by Voidlet)
o firmware: opnsense-code: some improvements with regard to core upgrades
o firmware: opnsense-bootstrap: fix bootstrap on FreeBSD 15 with pkgbase
o firmware: opnsense-prefetch: new tool for sets prefetching
o firmware: opnsense-sign: shell compatibility update
o firmware: adjust the incompatible pkg test
o firmware: disable FreeBSD-base repository and remove old definitions
o firmware: opnsense-patch: added -R mode and updated -N mode
o firmware: opnsense-prefetch: get remote size and print mismatches
o firmware: opnsense-prefetch: curl use is now optional
o firmware: add simple prompt to console changelog viewer
o firmware: tighten validation for mirror URL (reported by Abraxas Labs)
o firmware: revoke 26.1 fingerprint
o captive portal: move template actions out of the ServiceController into its own TemplateController
o captive portal: adjust accounting interval to Acct-Interim-Interval
o dhcrelay: add options for circuit_id and remote_id (contributed by Thomas Cheyney)
o dnsmasq: possible use before define in lease watcher
o dnsmasq: remove count badge from GroupBy with static configuration elements
o dnsmasq: add "expand-hosts" option (contributed by Konstantinos Spartalis)
o dnsmasq: leases sorting fixes (contributed by Greelan)
o intrusion detection: rename "uncategorized" rule package to "adult" (contributed by Konstantinos Spartalis)
o intrusion detection: fix displaying URL in descriptions (contributed by Konstantinos Spartalis)
o intrusion detection: always initialize reference_html (reported by Adam Korczynski of Ada Logics using Anrophic)
o ipsec: add "replay_window" option to children
o kea: remove count badge from GroupBy with static configuration elements
o kea: use DOM construction for the "dynamic" label
o kea: fix leases sorting (contributed by Greelan)
o kea: add ping check settings for subnet configuration (contributed by laozhoubuluo)
o kea: add setup.sh to create /var/log/kea before use
o monit: use LIBXML_NOCDATA on XML fetch
o monit: change "logfile" to "log" to fix syntax on newer daemon
o monit: log from the first line and reconfigure through the base class (contributed by IvanTheGeek)
o network time: strict security GUI support
o openvpn: moved legacy CARP hook to os-openvpn-legacy plugin
o openvpn: default keepalive to "10 60" in server mode and improve validation
o wireguard: add allowed-ips to reresolve-dns.py in case none are set yet
o wireguard: FreeBSD 15 no longer allows addresses without netmasks
o wireguard: cleaner QR codes (contributed by Roy Orbitson)
o wireguard: preserve peer generator state for existing peers
o acl: merge user management ACLs into one single privilege
o acl: fix patterns for gateway groups (contributed by Andrew Ferk)
o backend: allow "strict" mode +TARGETS using the preamble "!"
o backend: sanitize template filename replacements
o backend: further restrict actions to root and wwwonly for more sensitive actions
o backend: ensure strict templates are not reloaded via "*" wildcard
o backend: add CLOEXEC to a few file descriptor opens to avoid lock inheritance
o bootgrid: exclude header cells from status color rendering
o bootgrid: upgrade Tabulator to version 6.5.3
o mvc: refactor base_dialog and parseFormNode() to simplify the template
o mvc: remove unused argument from getFormGrid()
o mvc: BaseField: emit descriptions in getNodes() when they are not the same as the value to match getNodeContent()
o mvc: BaseField: add getInitialValue()
o mvc: BaseField: add getDefault() and isDefault() for future use
o mvc: PortField: reject whitespaces in port ranges during validation
o mvc: ModelRelationField: remove grouped option handling
o mvc: add file type to forms
o mvc: fix tab/subtab form generation for plugins
o mvc: fix default labels in selectpickers
o mvc: create runInterfaceRegistation() and use it for immediate device registration
o mvc: add some exception types and handle them in the base template
o mvc: clean up a number of stale imports
o mvc: OptionField: fix simplified option group definition
o mvc: fix typo in base_form.volt advanced/help toggle IDs
o mvc: fix assorted stale imports in the code base
o mvc: advanced marker for form/dialog fields
o mvc: fix stale imports for Message classes
o mvc: JsonAduditField: shared implementation for configuration revision tracking
o mvc: guard direct config saves against user-config-readonly (contributed by Andrew Ferk)
o mvc: disable Nginx reverse proxy buffering on configd streams
o mvc: dispatch failed message during reconfiguredAction()
o mvc: PortField: keep the first well-known service in the option list (contributed by fa1k3)
o mvc: PortField: always return a string for normalizedPort()
o mvc: UidField: allow an arbitrarily specified UID for system scope users upon creation
o mvc: UidField: revert "allow an arbitrarily specified UID for system scope users upon creation"
o mvc: UidField: add isolated updateValue() for installer user
o ui: add "opnsense-auto" theme which switches between "opnsense" and "opnsense-dark" depending on browser setting
o ui: decrease flashing in opnsense-auto theme when switching (contributed by Konstantinos Spartalis)
o ui: remove direct apply_btn_id usage in favour of base_apply_button template partial
o ui: fix menu registration not setting "active"
o ui: add tokenize2.css in standard theme to ensure selection in opnsense-auto theme
o ui: prevent blinking by hiding the contents while loading for opnsense-auto theme
o ui: fix collapsed sidebar stray line and restore rail divider in opnsense-dark theme (contributed by circa1665)
o ui: restore stacked layout for interfaces widget on narrow (contributed by circa1665)
o ui: fix minor JavaScript bugs in dashboard widget code (contributed by Thomas Schöpf)
o ui: do not freeze commands column on touchscreen devices
o ui: further fixes for base templates
o ui: fix empty legacy firewall menu container glitch
o ui: bootgrid: classname can depend on state, accept a callback function
o ui: tabulator: add _showMaximized() modal that can show a grid close to full screen
o ui: add keyboard shortcut "f" to maximize a currently visible grid
o ui: scope "all help" and "advanced mode" toggle to closest relevant form
o ui: trigger "h" and "a" keyboard shortcuts on all relevant matches
o ui: improve form matching for help/advanced
o ui: fix _showMaximized() height calculation when mobile navigation triggers below 768px width
o ui: attach selectors piped through replaceInputWithSelector to body
o ui: fix widget bottom gap in standard theme files (contributed by Konstantinos Spartalis)
o ui: sidebar fixes and rework (contributed by Team Rebellion)
o ui: remove spurious _formDialog portion of dialog IDs
o ui: implement dialog search field
o ui: ensure a minimum amount of rows to render in grids
o ui: only schedule grid dimension changes after data processing, window resizing and table visibility changes
o ui: remove defunct content-box-main usage
o ui: make settings-changed trigger overridable
o ui: fix blank bottom UI space (contributed by Konstantinos Spartalis)
o ui: do not add the spinner again when it fails
o ui: bootgrid: sync columnselect-input state with (un)setColumns
o ui: sync expanded state for selected submenus
o ui: close mobile menu when a menu entry opens another tab of the current page (contributed by Greelan)
o plugins: add error returns to plugins_configure()
o plugins: OPNBEcore 1.10
o plugins: OPNWAF 2.6
o plugins: OPNcentral 1.13
o plugins: os-acme-client 4.17[4]
o plugins: os-caddy 2.2.1[5]
o plugins: os-ddclient 1.33[6]
o plugins: os-firewall-legacy 1.1 contains the static PHP firewall rules pages[7]
o plugins: os-frr 2.0[8]
o plugins: os-intrusion-detection-content-at-antiphishing 1.0[9] (contributed by Julio Lira)
o plugins: os-iperf 2.0[10]
o plugins: os-ndp-proxy-go 1.5[11]
o plugins: os-ndproxy has been removed, use os-ndp-proxy-go instead
o plugins: os-net-snmp 1.7[12]
o plugins: os-nrpe 1.2[13]
o plugins: os-puppet-agent 2.0[14]
o plugins: os-sftp-backup 1.2 verify backups after put
o plugins: os-theme-cicada 1.42 (contributed by Greelan)
o plugins: os-theme-rebellion 1.9.8 (contributed by Team Rebellion)
o plugins: os-theme-tukan 1.32 (contributed by Team Rebellion)
o plugins: os-theme-vicuna 1.52 (contributed by Team Rebellion)
o plugins: os-turnserver 1.4[15]
o src: FreeBSD 15.1-RELEASE-p6 plus assorted stable/15 networking commits[16]
o src: pf: do not mangle IP header before shared forwarding
o src: pf: stop resolving hosts via DNS that use ":" modifier
o src: pf: clear anchor after stepping into it in pf_match_translation_rule()
o src: pf: pf_route() "dst" no longer holds the gateway in 15.x
o src: pf: add missing PF_TS_CNT netlink attribute
o src: pf: expose first rule label for states since rule number is insufficient
o src: usb: bpfattach() before if_attach()
o src: ena: update driver version to v2.8.4
o src: assorted minor commits from stable/15
o src: jail: restore ktrace privileges for jailed root[17]
o src: ktimer: check for errors from realtimer_gettime()[18]
o src: kqueue: avoid enqueuing an already-enqueued knote[19]
o src: zfs: multiple fixes[20]
o src: revert "daemon: replace memchr with memrchr"
o src: cred: fix group_is_primary()[21]
o src: unix: fix some bugs in the SOCK_STREAM receive path[22]
o src: netmap: fix driver name handling
o src: netmap: fix a race in kqueue registration
o src: e1000: assorted upstream patches from stable/15
o src: iflib: support recoverable initialization failure
o src: route: add an eventhandler for rt_numfibs changes
o src: rawip: fix handling of checksums in rip6_input()
o src: pf: attempt to handle overlapping group and interface names
o src: pf: check if a group has a kif before dereferencing it
o src: pf: fix fallout from the STATE_LOOKUP macro removal
o src: pf: re-optimize state key handling
o src: pf: rule label patch was merged from a wrong version
o src: pfsync: handle large MTU pfsync interfaces
o src: ktls: propagate EPG_FLAG_ANON to mapped mbufs
o src: netipsec: fix sockaddr type set in ipcomp6_nonexp_encapcheck()
o src: PF_KEY socket: limit the length of copied socket address
o src: ure: add USB device IDs for additional RTL8152/RTL8153 adapters
o src: ure: fix spurious link flaps from MII
o src: ciss: revert patch that added max physical target
o src: pf: do not set a null rule pointer during test
o src: pf: fix securelevel off-by-one
o src: pfctl: fix printing of wildcard anchors
o src: e1000: more assorted upstream patches from stable/15
o src: ixgbe: assorted upstream patches from stable/15
o src: virtio_p9fs: disallow detach if a session is in progress
o src: route/fib_algo: free leaked radix_masks in radix_lockless
o src: netipsec: implement pr_disconnect for PF_KEY sockets
o src: iflib: assorted upstream patches from stable/15
o src: net: add ifmedia support for 10GBase-BX BiDi
o src: bnxt: report initialization failures to iflib
o src: bnxt: add led(4) identification support
o src: ice: add led(4) identification support
o src: ice: report initialization failures to iflib
o src: ice: add support for E835 CNSA 2.0 adapters
o src: ice: add two more 4-part IDs for E835 adapters
o src: if_vxlan: fix panic by validating unused drvspec values
o src: qat: driver updates to enhance qat infrastructure
o src: ath10k: remove some early FreeBSD-specific debugging
o src: ip(6)_mroute: assorted upstream patches from stable/15
o src: in_mcast: fix uninitialized variable usage in inm_merge()
o src: bind: lookup local address in current FIB if "*.bind_all_fibs" is active
o src: net: add fib-aware ifa_ifwithaddr()
o src: kqueue: memory safety bugs in kqueue copy-on-fork implementation[23]
o src: syslogd: fix leaking child processes when logging to a pipe[24]
o src: iflib: do not hold the ifnet lock across registration
o src: ixgbe: correct Wake-on-LAN configuration
o src: dummynet: do not overflow the points[ED_MAX_SAMPLES_NO] array
o src: pf: mark non-port packets to require IP checksumming
o src: pf: set the correct type for rule timeouts
o src: loopback: improve checksum offloading
o src: vlan: use the exclusive lock everywhere
o src: raw ip: clear sin_port on bind(2)
o src: nd6: fix regeneration of temp addresses in detached state
o src: hyperv: fix single page invalidation path
o src: route/fib_algo: fix nexthop index collision across families
o src: ice: do not leave device non-functional if Tx scheduler config fails
o src: netipsec: fix V_spd_size updates
o src: bnxt: assorted updates from stable/15
o src: ixl: assorted updates from stable/15
o src: linxkpi: assorted updates from stable/15
o src: net80211: assorted updates from stable/15
o src: pci: assorted updates from stable/15
o src: pf: send syncookies from the receiving thread
o src: hyperv: fix two regressions in previous upstream patch
o src: pcib: only apply ARI translation to the own secondary bus of a bridge
o src: ktls CBC decrypt: avoid creating zero length iovec entries
o src: route/fib_algo: respect immediate_sync in fd_ref_nhop
o src: route/fib_algo: fix FIB_ALGO without ROUTE_MPATH option
o src: sysctl: retire SYSCTL_NODE_CHILDREN()
o src: caroot: TLS certificate store update due to eMudhra compromise[25]
o src: bhyve: multiple vulnerabilities in bhyve device models[26]
o src: sound: TOCTOU race between sound(4) buffer resizing and mmap[27]
o src: tcp: remotely triggerable buffer overflow in tcp_rack[28]
o src: tcp: TCP timers may overflow and fire late or not at all[29]
o src: hastd: multiple issues in hastd(8)[30]
o src: tzdata: import tzdata 2026e[31]
o ports: ca_root_nss / nss 3.132[32]
o ports: curl 8.23.0[33]
o ports: dhcp6c fix for truncated env vars in dhcp6c-script (contributed by Michael Zimmermann)
o ports: dpinger 3.6
o ports: expat 2.8.5[34]
o ports: filterlog 0.9 support for pflog actions on FreeBSD 15
o ports: hostapd / wpa_supplicant 2.12
o ports: kea 3.0.4[35]
o ports: libevent 2.1.13[36]
o ports: libxml 2.15.4[37]
o ports: lighttpd 1.4.85[38]
o ports: monit 6.0.0[39]
o ports: openldap 2.6.15[40]
o ports: openssl 3.5.9[41]
o ports: pcre2 10.49[42]
o ports: pecl-mcrypt 1.0.9
o ports: perl 5.42.3[43]
o ports: phalcon 5.22.1[44]
o ports: php 8.5.12[45]
o ports: phpseclib 3.0.57[46]
o ports: pkg 2.8.4
o ports: py-duckdb 1.5.6[47]
o ports: rrdtool 1.11.0[48]
o ports: sqlite 3.53.4[49]
o ports: unbound 1.26.2[50]
Migration notes, known issues and limitations:
o The privileges "page-system-groupmanager" and "page-system-usermanager-addprivs" were merged into "page-system-groupmanager" and are no longer available separately. This was done to avoid the misconception that access to a user management page gives constrained rights to each page, but that is not the case. User management is a process involving all 3 pages.
o The static PHP pages for firewall rule and outbound NAT management have been moved to the "os-firewall-legacy" plugin which can be manually installed before or after the upgrade. All rules will continue to work regardless of the plugin being installed or not and are easily migrated using the given assistant.
o Since this is a major OS upgrade and OpenSSL changes from 3.0 to 3.5 third party repositories may interfere with your upgrade experience. Removing offending repositories and plugins may help; or wait for affirmation from the respective repository owners.
o The CPU microcode early loading has been known to be flaky on some setups. A fix is in the FreeBSD 15.1 boot loader code, but can only be reached by reinstall or manually updating the boot code of your system after the upgrade succeeded. If you want to be on the safe side during the upgrade itself please remove the plugin before proceeding.
The public key for the 26.10 series is:
-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAziSNKuzrL2cwLx5LXmLn
cWS5Lk+i9CzRMXO/4xQYBQCaSnd8GBg/HA/g4aPoTUa6ovAI0AHfW8KQJQyBkFzn
pi6MLZJ9tEaFcn0CiV+tSTJd1RV4bB8jtpKl5oTkgFrPsyaB7iBlG5Cd49VCW19h
DxClQ24lkWkVoYfsfCQEt4ADNGLygWCPyf4bxGD/t6/tiW9SsOs2+gfOZ9C/G2d/
EBhJFoBEoz5lvULVxTdfY5PScYrHD/waZnk3rGc2A+9pI/SM2JAwKqsgZ6MSFbXO
DNocSjqFUUkdqhty+Qcc0OJ+hMbKKVE+f3QJBQIwT3ayys8QK0m5CCo91/f+DjoN
noj+t5YN9x8GREkF0wrdIi7hevkwrL2/SJQbq1bL1BLB+mMSXYR611lgT8YfYjyZ
7tmpNVC3O5Pj7l20snm1lVUSqS0PsFBvh6HQtBRwQDGppaIIhH1Nt9yIatmSiGZt
2YrMVNBzbQrJzSX+vWcAulkaPIt4t+XxmpO5IDNZ+4uMZ7XyJq1lAhIeyXx+Falf
v7S+ZpJWFVNz0/N5z6lBbADD855i+gFY6B5209xGyhd6FwaPOjISgQKkgBwF1AiW
MDuTuP9lkh/U5gGBZIFTnbdEMgOAL4P+Hsw9Nozav+3QIpiU3Pv9F29a1erCkq09
rpQyNglY7Jqme/RipzbYia8CAwEAAQ==
-----END PUBLIC KEY-----
Stay safe,
Your OPNsense team
--
SHA256 (OPNsense-business-26.10-dvd-amd64.iso.bz2) = e746a1a817480fd2c432611d399a7e3e49d6c35e70c748b4d56fb0c30ff892d9
SHA256 (OPNsense-business-26.10-nano-amd64.img.bz2) = 25bd59e97da0ca5bd345ee4c162560dfe012bdf1c0e197dccdd0a59211080ebb
SHA256 (OPNsense-business-26.10-serial-amd64.img.bz2) = 270c26642c5e2bc27d23fd359c68d0235fae3e7a5b5e3bdae2076bddc8d3f887
SHA256 (OPNsense-business-26.10-vga-amd64.img.bz2) = 259c64cf20e3224224afe702697dfc28a8ab6ee98a0704b201c3b0b8105ac8dc
[1] https://docs.opnsense.org/manual/install.html
[2] https://github.com/opnsense/core/security/advisories/GHSA-9h93-hhcx-957c
[3] https://github.com/opnsense/core/security/advisories/GHSA-p683-f7x2-pm4p
[4] https://github.com/opnsense/plugins/blob/stable/26.7/security/acme-client/pkg-descr
[5] https://github.com/opnsense/plugins/blob/stable/26.7/www/caddy/pkg-descr
[6] https://github.com/opnsense/plugins/blob/stable/26.7/dns/ddclient/pkg-descr
[7] https://github.com/opnsense/plugins/blob/stable/26.7/net/firewall-legacy/pkg-descr
[8] https://github.com/opnsense/plugins/blob/stable/26.7/net/frr/pkg-descr
[9] https://julioliraup.github.io/AT/
[10] https://github.com/opnsense/plugins/blob/stable/26.7/benchmarks/iperf/pkg-descr
[11] https://github.com/opnsense/plugins/blob/stable/26.7/net/ndp-proxy-go/pkg-descr
[12] https://github.com/opnsense/plugins/blob/stable/26.7/net-mgmt/net-snmp/pkg-descr
[13] https://github.com/opnsense/plugins/blob/stable/26.7/net-mgmt/nrpe/pkg-descr
[14] https://github.com/opnsense/plugins/blob/stable/26.7/sysutils/puppet-agent/pkg-descr
[15] https://github.com/opnsense/plugins/blob/stable/26.7/net/turnserver/pkg-descr
[16] https://www.freebsd.org/releases/15.1R/relnotes/
[17] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:53.ktrace.asc
[18] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:51.ktimer.asc
[19] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:50.kqueue.asc
[20] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:19.zfs.asc
[21] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:59.mac_do.asc
[22] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:57.unix.asc
[23] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:65.kqueue.asc
[24] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:23.syslogd.asc
[25] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:73.caroot.asc
[26] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:72.bhyve.asc
[27] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:71.sound.asc
[28] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:70.tcp.asc
[29] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:27.tcp.asc
[30] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:26.hastd.asc
[31] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:25.tzdata.asc
[32] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_132.html
[33] https://curl.se/changes.html#8_23_0
[34] https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/Changes
[35] https://gitlab.isc.org/isc-projects/kea/-/wikis/Release-Notes/release-notes-3.0.4
[36] https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
[37] https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.15.4/NEWS
[38] https://www.lighttpd.net/2026/07/08/1.4.85/
[39] https://mmonit.com/monit/changes/
[40] https://www.openldap.org/software/release/changes_lts.html
[41] https://github.com/openssl/openssl/blob/openssl-3.0/CHANGES.md
[42] https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.49
[43] https://perldoc.perl.org/5.42.3/perldelta
[44] https://github.com/phalcon/cphalcon/releases/tag/v5.22.1
[45] https://www.php.net/ChangeLog-8.php#8.5.9
[46] https://github.com/phpseclib/phpseclib/releases/tag/3.0.57
[47] https://github.com/duckdb/duckdb/releases/tag/v1.5.6
[48] https://github.com/oetiker/rrdtool-1.x/releases/tag/v1.11.0
[49] https://sqlite.org/releaselog/3_53_4.html
[50] https://nlnetlabs.nl/projects/unbound/download/#unbound-1-26-2
#9
26.7, 26.10 Series / Re: Changing to Business editi...
Last post by sopex - Today at 12:58:35 PMI am going to eat, you have 1 hour.
#10
26.7, 26.10 Series / Re: 26.7.7 — Security audit re...
Last post by Manfred.Knick - Today at 12:50:01 PMQuote from: cfarachid on October 27, 2026, 12:10:16 AMFor a single-firewall small business, I will stay on the Community Edition for now and monitor the security updates closely.
Even if 'small': still 'business'. So don't. Upgrade to BE.
Proven since 2020.
3y license cost per annum: neglegible.
Spare your "add-on monitoring" efforts: Franco et al. are perfect at it.
Better make money with your business (where you are perfect at)
and spend some additional donations from those revenues.
