OPNsense aarch64 firmware repository

[Maurice]

Hello all,

After testing OPNsense on ARM64 (aarch64) virtual machines for some time, I've decided to make my firmware repository public. It can be used for installing updates and plugins on existing OPNsense aarch64 systems, for quickly building aarch64 images and for turning a stock FreeBSD aarch64 release into an OPNsense installation. Updates typically get published within 24 hours of the official amd64 updates.

https://opnsense-update.walker.earth


Configure OPNsense to use the repository for downloading updates and plugins

• Add the fingerprint to OPNsense:
  

  fetch -o /usr/local/etc/pkg/fingerprints/OPNsense/trusted https://raw.githubusercontent.com/maurice-w/opnsense-core/stable/26.7/src/etc/pkg/fingerprints/OPNsense/trusted/opnsense-update.walker.earth.20260715

• Change the firmware mirror:
  'System: Firmware: Settings'
  Mirror    (custom)
                  https://opnsense-update.walker.earth

Build aarch64 images

• Follow the instructions on https://github.com/opnsense/tools
• Before invoking make arm or make vm, prefetch the sets:
  

  make prefetch-base,kernel,packages MIRRORS=https://opnsense-update.walker.earth

For building VM images, my fork of the OPNsense tools allows configuring the default console. Sample VM images are available in the releases section.


Turn a stock FreeBSD 15.1-RELEASE into an OPNsense installation

fetch https://raw.githubusercontent.com/opnsense/update/master/src/bootstrap/opnsense-bootstrap.sh.in
sh ./opnsense-bootstrap.sh.in -r 26.7 -A maurice-w -R opnsense-core

opnsense-bootstrap only works on FreeBSD installations which use traditional distribution sets. This excludes official FreeBSD VM and cloud images, which use a packaged base system.


None of this is supported by Deciso or the OPNsense core team! Use at your own risk.


Thanks to everyone who contributed to OPNsense-aarch64. I only use the tools others have created.

Cheers
Maurice

GitHub Sponsors is available as an option if you'd like to support these efforts.

The public key for my 26.7-aarch64 packages and sets is:

Code Select Expand

-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApvUV3IH2wv4si/pn9tOH
mwlG6a7j5PIT7nQqZo82P8XhFaIbz2Ox8e0TIBjSUfauwvXveBso1RNeMXyUqD3Q
HeJllPK8Zezwmf+kC+rGaDfS6cEah0i8Yzh9UAcFWdcaur9vV+fVKpHFBBxImY+E
oTfClxk49DfGhbKzIpPn3m7MWjkIhX9to2Nt/DoIlwDKAx+WH7UT0oe8STzxNU1P
7Z2HOBdSZBmJ+hCca1GKvRQfPi8R01JV5rQlSrVILXTv7dMLSuTNWcj/7e2B5ICU
RvlXBI9x/RB5cfhLajFy44Kp1QjVQyZe7s5n2uRsgVbdfn1iuoi1E6QESF3I9HYL
/VGdZ8PNB+ochxLxQcqR2UsvN8zN65mIZlbLGsKQky86MZnmuQQShvtqF8aQGHKD
+Fon9t+herqludbyZEU7usx6rCuRpKlAZltk9WazGXYONRjNlooPt83U1W0zEsUx
v491dsba1FxobLwhexJho3Nvhm6bh2bMNCp6U7mW55Kx0sbdKoTE2gQEVWZM/GSN
QTluB2YVUO2JnImx237TUIA0BpiM2vCLB2vlZyeAhTOcRs5EvFVTigsPnEJpemcr
yvToS8dgTXFyPdHtgrzaaiPn0LnVNJpBESkJKXlB50JeVGFSJ4MED9PuFQCDAyyF
MhVrYn5inErBHSMR4Txfmi0CAwEAAQ==
-----END PUBLIC KEY-----


[franco]

Nice. Thanks for your work!

Only for reference: what's your update strategy? Providing snapshots (time frame?) or follow stable releases?


Cheers,
Franco

[Maurice]

The plan is to follow stable releases. So far I've released packages and sets matching the 23.7, 23.7.1, 23.7.2 and 23.7.3 tags. When you release an official update, I fire up my build system and set the VERSION accordingly.

Not entirely sure how to deal with hotfixes yet. My 23.7.3 packages do include the hotfixed os-wireguard 2.0_2, but the 23.7.1 packages do not include opnsense 23.7.1_3.

Cheers
Maurice

[franco]

Hotfixes are tricky indeed as they leave the basic formula of building what is tagged.

I wouldn't worry too much about these if you don't happen to be able to pick them up right away (build delay). Following releases sounds like a working strategy for everyone using this. :)

Snapshots are handy too, but too many surprises on updates.

I also see you don't publish development packages (EXTRABRANCH=master). The feature formerly known as "rewind" doesn't like this anyway. It's almost like snapshot releases inside the stable releases so not needed as well.


Cheers,
Franco

[Monviech (Cedrik)]

Did you get any experience with the performance of a Raspberry Pi 4?

I'm kinda curious since I have a few CM4 with waveshare boards, some with pcie nvme or with pcie 2 Nics. But if you already made some tests yourself it would be nice to know what to expect.

I'll definitely try to build it and implement your firmware repo for tests, thank you.

[Maurice]

I'm currently using this on Ampere Altra based Cloud VMs exclusively (which works flawlessly). Don't own a Raspberry Pi.

yrzr.tk offers images for RPI and well-written docs. They've contributed a lot to OPNsense-aarch64. 👍🎉

[Maurice]

OPNsense 23.7.4 aarch64 packages and sets released.

Cheers
Maurice

[Maurice]

OPNsense 23.7.5 aarch64 packages and sets released.

[Maurice]

OPNsense 23.7.6 aarch64 packages and sets released.

[hushcoden]

Why don't you make this a sticky post?

[franco]

Waited for someone to ask about it ;)

[Abbott]

I use the build of https://github.com/yrzr/opnsense-tools/releases
This repo worked for me.

Thank you very much.

[Maurice]

Yep, yrzr's work was the inspiration for my own repo. Their focus clearly is on images for various devices (RPI etc.), while mine is on virtualization and frequent updates.

Expect 23.7.7 by tomorrow.

Cheers
Maurice

[Maurice]

OPNsense 23.7.7 aarch64 packages and sets released. Includes hotfix 23.7.7_1.

[Update 2023-10-29]
Hotfix 23.7.7_3 released.

[Maurice]

OPNsense 23.7.8 aarch64 packages and sets released.

[Update 2023-11-13]
Hotfix 23.7.8_1 released.