[CALL FOR TESTING] FreeBSD 11.1, newer Realtek vendor driver and more

[franco]

Hi guys,

As a twist to our normal beta images, this time around we simply offer a manual upgrade of the operating system code, which means your GUI release version stays and follows 17.7.x if you want to.

All the updates and commands found here are signed and verified to allow a secure and stable update experience as usual.

On top of our HardenedBSD additions this new OS version for OPNsense 18.1 received the following improvements:

o Shared forwarding now works on IPv6, in conjunction with "tryforwarding" and better reply-to multi-WAN behaviour
o A potential fix for the high CPU load of the SNMP hostres module
o Realtek vendor NIC driver version 1.94
o FreeBSD 11.1, see https://www.freebsd.org/releases/11.1R/relnotes.html

The move to this new OS version is simple:

# opnsense-update -bkgr 18.1.b -n "snapshots\/beta"
# opnsense-update -L
# /usr/local/etc/rc.reboot

To explain, we are installing the b(ase), (debu)g k(ernel), r(elease) 18.1-BETA from mirror (locatio)n snapshots/beta.

The second command locks the base and kernel to prevent upgrades to switch back to 17.7.1.

The third command, as you would have guessed, issues the reboot.

From an operational standpoint, we've seen no differences to FreeBSD 11.0 and the behaviour is the same, but would like you to help pinpoint potential issues and hiccups as covering all use cases and hardware can only be a team effort.

Should there be any need to switch back to 11.0 / 17.7 you can run the following to revert your system:

# opnsense-update -U
# opnsense-update -bkd
# /usr/local/etc/rc.reboot

Unlock the kernel and base, update standard k(ernel) and b(ase) from the d(efault) location, and reboot.

That's all, have fun!


Thanks,
Franco

[DanMc85]

opnsense-update -bkgr 18.1.b -n "snapshots\/beta"

This command isn't working properly for me.  It Fetches the first file ****.obsolete... done  the second file *****.txz comes up with an opnsense-verify error 04091068 rsa routines  bad signature.  Signature is not valid.

Any ideas?

My current build:
OPNsense 18.1.a_291-amd64
FreeBSD 11.0-RELEASE-p12
OpenSSL 1.0.2l 25 May 2017

[franco]

Which mirror are you using?

Since the first one goes through this could mean thee things in order of increasing possibility:

1. The mirror has a faulty set file.
2. Your download was truncated by your network.
3. There was not enough space on your OPNsense to store the full set.


Cheers,
Franco

[tillsense]

Hi Franco,

a proxmox vm has been stable for 10h.

Code: [Select]

...
Kernel locked at 18.1.b-amd64, skipping.
Base locked at 18.1.b-amd64, skipping.
OPNsense 18.1.a_292-amd64
FreeBSD 11.1-RELEASE-p2
OpenSSL 1.0.2l 25 May 2017

cheers till

[Solaris17]

Followed the directions and still ended with

Code: [Select]

OPNsense 17.7.7_1-amd64
FreeBSD 11.1-RELEASE-p2
OpenSSL 1.0.2l 25 May 2017
That doesnt seem right? Attempting to do it again after reboot shows that I am "upto date skipping"

Though the OP does say

As a twist to our normal beta images, this time around we simply offer a manual upgrade of the operating system code, which means your GUI release version stays and follows 17.7.x if you want to.

others report GUI change of 18.x ?

[tillsense]

@Solaris17 @all

17.7.x is ok i'm in addition on the opnsene devel package over git.

cheers till

[Ren]

I just updated to 18.1 and Opnsense Version number did not change. Is it suppose to change to 18.1 ? FreeBSD Version got updated to 11.1 and i did get driver version 1.94.01 for my realtek NICS


OPNsense 17.7.7_1-amd64
FreeBSD 11.1-RELEASE-p2
OpenSSL 1.0.2l 25 May 2017

[phoenix]

I just updated to 18.1 and Opnsense Version number did not change. Is it suppose to change to 18.1 ?

No, it's not supposed to change and the answer is in the first paragraph of the first post in this thread.

[franco]

Hi,

Sorry for not being more clear... OPNsense version stays at 17.7.x, if you lock the kernel and base you'll simply stay on 11.1 instead of going back to 11.0 on updates.

18.1.x is reached via:

# opnsense-update -t opnsense-devel

But at this point there is not a lot of interesting things in there as most of it went to 17.7.x already.

To switch back, type:

# opnsense-update -t opnsense


Cheers,
Franco

[Ren]

I just updated to 18.1 and Opnsense Version number did not change. Is it suppose to change to 18.1 ?

No, it's not supposed to change and the answer is in the first paragraph of the first post in this thread.

Oh ok. I think i glossed over it last night. Thank you

[Ren]

Hi,

Sorry for not being more clear... OPNsense version stays at 17.7.x, if you lock the kernel and base you'll simply stay on 11.1 instead of going back to 11.0 on updates.

18.1.x is reached via:

# opnsense-update -t opnsense-devel

But at this point there is not a lot of interesting things in there as most of it went to 17.7.x already.

To switch back, type:

# opnsense-update -t opnsense


Cheers,
Franco

Thanks for the info

[Julien]

I have installed this new Kernel on a real hardware.
Where are we supposed to pay attention ?
Thank you

[franco]

Hi Julien,

Apart from the particular points stated above there is no new test-worthy addition. Just look out for stability issues. But as I said, it's been tested for a while now and has shown good quality.


Cheers,
Franco

[Julien]

Hi Julien,

Apart from the particular points stated above there is no new test-worthy addition. Just look out for stability issues. But as I said, it's been tested for a while now and has shown good quality.


Cheers,
Franco

I am working on it and I agree performance is great,
I will wait a week and go for it on productions with one site and check the behaivor.
today i've recieved two updates which i installed them however after i check for the updates they pop ups again.
i have rebooted the appliance twice but it still shows up.
thought i'd share here

[franco]

Yes, you are running opnsense-devel and I added kernel/base support there. But you can't install the 17.7.1 kernel and base because you locked them to stay at 18.1-BETA with "opnsense-update -L" so everything is as it should be.


Thanks,
Franco