OPNsense 26.7-BETA images

[franco]

Hi all,

Behind the scenes we were working on providing the first images for the upcoming 26.7 series. We aligned with the FreeBSD 15.1 release schedule and fixed all the installer compatibilities we've found. From early testing FreeBSD 15.1 behaves pretty well. The main difference from current community versions is PHP 8.5, OpenSSL 3.5 and that this image is only containing the development version. Upgrades to future versions are possible.

For now there's no path to upgrade from an existing 26.1.x but manual instructions can be shared once 26.1.11 is released next week. 26.7-RC1 will also add the stable release path.

You can find the usual images here:

https://pkg.opnsense.org/FreeBSD:15:amd64/snapshots/misc/26.7.b/

SHA256 (OPNsense-devel-26.7.b-dvd-amd64.iso.bz2) = 73fb138ae4ea0f2eccb1f7966a88f78d863a012f15b314105a5533f74b27abad
SHA256 (OPNsense-devel-26.7.b-nano-amd64.img.bz2) = 79c881c87af8fe27eef4d5a94cb7d211296870dc5fcfc00bc409c62fbdaa441f
SHA256 (OPNsense-devel-26.7.b-serial-amd64.img.bz2) = d7f257c7360c840e9d16360ef973cb6ca6b0b9ee10f761751d471ed92f16a0d7
SHA256 (OPNsense-devel-26.7.b-vga-amd64.img.bz2) = 62622a0a1a9954f77edde657fc8c66115977cd115737f475ec53aecc2b97117c

The public key for 26.7 is as follows:

-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAziSNKuzrL2cwLx5LXmLn
cWS5Lk+i9CzRMXO/4xQYBQCaSnd8GBg/HA/g4aPoTUa6ovAI0AHfW8KQJQyBkFzn
pi6MLZJ9tEaFcn0CiV+tSTJd1RV4bB8jtpKl5oTkgFrPsyaB7iBlG5Cd49VCW19h
DxClQ24lkWkVoYfsfCQEt4ADNGLygWCPyf4bxGD/t6/tiW9SsOs2+gfOZ9C/G2d/
EBhJFoBEoz5lvULVxTdfY5PScYrHD/waZnk3rGc2A+9pI/SM2JAwKqsgZ6MSFbXO
DNocSjqFUUkdqhty+Qcc0OJ+hMbKKVE+f3QJBQIwT3ayys8QK0m5CCo91/f+DjoN
noj+t5YN9x8GREkF0wrdIi7hevkwrL2/SJQbq1bL1BLB+mMSXYR611lgT8YfYjyZ
7tmpNVC3O5Pj7l20snm1lVUSqS0PsFBvh6HQtBRwQDGppaIIhH1Nt9yIatmSiGZt
2YrMVNBzbQrJzSX+vWcAulkaPIt4t+XxmpO5IDNZ+4uMZ7XyJq1lAhIeyXx+Falf
v7S+ZpJWFVNz0/N5z6lBbADD855i+gFY6B5209xGyhd6FwaPOjISgQKkgBwF1AiW
MDuTuP9lkh/U5gGBZIFTnbdEMgOAL4P+Hsw9Nozav+3QIpiU3Pv9F29a1erCkq09
rpQyNglY7Jqme/RipzbYia8CAwEAAQ==
-----END PUBLIC KEY-----


The roadmap has a few more insights on what to expect: https://opnsense.org/roadmap/


Cheers,
Franco

[patient0]

Ran an upgrade from a 26.7.b_68 VM on Proxmox on Hetzner using OPNsense-devel-26.7.b-dvd-amd64.iso/26.7.b_110.

Booting into the DVD, importing the config from the zroot pool and then ran the installer. Went all smooth, few missing packages which I replaced with the *-devel package variant.

• WAN is set to a static private IPv4 and IPv6/ULA (Proxmox does the NAT-ting)
• LANs have static IPv4 and IPv6 (different ULA), with outbound NAT for both IPv4 and IPv6
• Tayga does what it doas
• KEA for DHCPv4/v6
• Unbound for DNS

All of the above works as it worked before, thanks Devs for the excellent work!

Remark: All the IPv6 NAT-ting is just because I can, I could have solved it different with less NAT but where is the fun in that.

Remark II: I had to re-enable console password protection, otherwise the installer - after importing the config - shows the console menu as user root and I couldn't run the installer. Just a reminder to my future self.

[franco]

Sali and thanks for checking this out so quickly!

> All of the above works as it worked before, thanks Devs for the excellent work!

Lovely to hear.

> Remark: All the IPv6 NAT-ting is just because I can, I could have solved it different with less NAT but where is the fun in that.

That's a good benchmark for regressions and happy to hear that nothing was visible on that front.

> Remark II: I had to re-enable console password protection, otherwise the installer - after importing the config - shows the console menu as user root and I couldn't run the installer. Just a reminder to my future self.

You can literally at any point in time go to option 8 and type "opnsense-installer" in the console.


Cheers,
Franco

[newsense]

@patient0 Were you on using there the new FW rules or haven't migrated yet?

[patient0]

@patient0 Were you on using there the new FW rules or haven't migrated yet?

I had migrated the firewall rules some time ago, the VM is running latest devel since OPNsense 25.
But I just realized I have not migrated the outbound NAT rules yet. So these two (one for IPv4 and one for IPv6) were and still are in the legacy 'Outbound' section.

Addition: I just tried exporting the two Outbound NAT rules in the migration assistant and it did throw an error:

{"errorMessage":"fputcsv(): the $escape parameter must be provided as its default value will change","errorTrace":"#0 [internal function]: {closure:/usr/local/opnsense/www/api.php:27}(8192, 'fputcsv(): the ...', '/usr/local/opns...', 198)\n#1 /usr/local/opnsense/mvc/app/controllers/OPNsense/Base/ApiControllerBase.php(198): fputcsv(Resource id #8, Array, ';')\n#2 /usr/local/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/MigrationController.php(79): OPNsense\\Base\\ApiControllerBase->exportCsv(Array)\n#3 /usr/local/opnsense/mvc/app/library/OPNsense/Mvc/Dispatcher.php(166): OPNsense\\Firewall\\Api\\MigrationController->downloadOutboundAction()\n#4 /usr/local/opnsense/mvc/app/library/OPNsense/Mvc/Router.php(156): OPNsense\\Mvc\\Dispatcher->dispatch(Object(OPNsense\\Mvc\\Request), Object(OPNsense\\Mvc\\Response), Object(OPNsense\\Mvc\\Session))\n#5 /usr/local/opnsense/mvc/app/library/OPNsense/Mvc/Router.php(139): OPNsense\\Mvc\\Router->performRequest(Object(OPNsense\\Mvc\\Dispatcher))\n#6 /usr/local/opnsense/www/api.php(36): OPNsense\\Mvc\\Router->routeRequest('/api/firewall/m...', Array)\n#7 {main}"}

[franco]

This patch should help:

# opnsense-patch https://github.com/opnsense/core/commit/5716c7184


Cheers,
Franco

[newsense]

@patient0 Thanks. And your setting in Outbound NAT was Automatic, Hybrid or Manual?

[patient0]

@patient0 Thanks. And your setting in Outbound NAT was Automatic, Hybrid or Manual?

@newsense: it is set to 'Hyprid'

[patient0]

Forgot: thanks franco for the remark about "... go to option 8 and type "opnsense-installer" in the console.", I didn't know that.

This patch should help:

# opnsense-patch https://github.com/opnsense/core/commit/5716c7184

That didn't resolve it for me, the patch did apply find though.

Syste: Firmware: Reporter (without the dmesg)

Code Select Expand

--- system information ---
User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
FreeBSD 15.1-RELEASE volatile/26.7-n283588-da0c912a9737 SMP amd64
OPNsense 26.7.b_110 a1d16690c
Plugins os-bind-devel-1.34_2 os-crowdsec-devel-1.0.12 os-git-backup-devel-1.1_3 os-nextcloud-backup-devel-1.2 os-qemu-guest-agent-devel-1.3 os-sftp-backup-devel-1.1_2 os-tailscale-devel-1.4 os-tayga-devel-1.5 os-theme-cicada-devel-1.41_1 os-theme-rebellion-devel-1.9.4 os-theme-vicuna-devel-1.51 os-zerotier-devel-1.3.2_6
Time Sat, 27 Jun 2026 10:14:26 +0200
OpenSSL 3.5.7
Python 3.13.14
PHP 8.5.7

--- PHP Errors: ---
[27-Jun-2026 10:11:35 Europe/Berlin] ErrorException: fputcsv(): the $escape parameter must be provided as its default value will change in /usr/local/opnsense/mvc/app/controllers/OPNsense/Base/ApiControllerBase.php:198
Stack trace:
#0 [internal function]: {closure:/usr/local/opnsense/www/api.php:27}(8192, 'fputcsv(): the ...', '/usr/local/opns...', 198)
#1 /usr/local/opnsense/mvc/app/controllers/OPNsense/Base/ApiControllerBase.php(198): fputcsv(Resource id #9, Array, ';', '\\')
#2 /usr/local/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/MigrationController.php(79): OPNsense\Base\ApiControllerBase->exportCsv(Array)
#3 /usr/local/opnsense/mvc/app/library/OPNsense/Mvc/Dispatcher.php(166): OPNsense\Firewall\Api\MigrationController->downloadOutboundAction()
#4 /usr/local/opnsense/mvc/app/library/OPNsense/Mvc/Router.php(156): OPNsense\Mvc\Dispatcher->dispatch(Object(OPNsense\Mvc\Request), Object(OPNsense\Mvc\Response), Object(OPNsense\Mvc\Session))
#5 /usr/local/opnsense/mvc/app/library/OPNsense/Mvc/Router.php(139): OPNsense\Mvc\Router->performRequest(Object(OPNsense\Mvc\Dispatcher))
#6 /usr/local/opnsense/www/api.php(36): OPNsense\Mvc\Router->routeRequest('/api/firewall/m...', Array)
#7 {main}
[27-Jun-2026 10:11:58 Europe/Berlin] PHP Warning:  Undefined array key "network" in /usr/local/www/firewall_nat_out.php on line 471
Shall I open an GH issue for it?

[franco]

Sure, open an issue, although it should fix it as it adds the parameter. I can check later.


Cheers,
Franco

[patient0]

Sure, open an issue, although it should fix it as it adds the parameter. I can check later.

I first try with a fresh installation and see if the same pops up.