Here is your biweekly dose of bugfixes and quality of life improvements! This update offers several new features: VLANs on bridges, “received-on” firewall rule support, persistent rule label tracking, repeatable WireGuard QR codes, menu favourites and full screen grid support. On top of that it bundles the recent FreeBSD 15.1-RELEASE-p3, fixes and cleanups as well as third party updates such as OpenSSL 3.5.8 and OpenSSH 10.5p1. Enjoy. :)

Meanwhile, development is busy with adding interface settings to the new MVC assignments page, which includes building wireless MVC/API support. That is all for now. Need to get back to work.

Here are the full patch notes:

system

• offer post-quantum mldsa44-ed25519 OpenSSH server host key
• do not regenerate all OpenSSH key files when adding new key types
• truncate long names in services dashboard widget (contributed by circa1665)
• use created user name for change event (contributed by Julian Pawlowski)
• handle missing objects during deletion in API (contributed by Julian Pawlowski)
• multiple PHP warning fixes (contributed by Julian Pawlowski)
• avoid filter_configure() calls to make existing backend call less obscure
• add favorites section to menu (contributed by Greelan)
• approximate user being expired for the grid view icon
• replace cron restart in static PHP pages
• fix server certificate purpose detection for EC

interfaces

• permit a VLAN device as bridge member
• resolve VLAN devices indirectly via interfaces_configure()
• handle missing GRE and GIF during deletion in API (contributed by Julian Pawlowski)
• multiple PHP warning fixes (contributed by Julian Pawlowski)
• emit discovered hosts sorted by last_seen via hostwatch

captive portal

• exclude IPv4 from roaming logic

dhcrelay

• add options for circuit_id and remote_id (contributed by Thomas Cheyney)

dnsmasq

• remove count badge from GroupBy with static configuration elements
• add “expand-hosts” option (contributed by Konstantinos Spartalis)

firewall

• remove 2a10::/12 from bogonsv6.sample (contributed by Belgarion)
• deprecate old rule register function names due to functional overlaps
• add missing TLS ports to well-known ports (contributed by Self-Hosting-Group)
• use new “rlabel” from pfctl for persistent rule identification across reloads
• emit gateway debug message in block rules only when gateway is not empty
• aliases: use same dynamic label as in KEA DHCPv6 for a unified look
• aliases: fix spinner on alias dialog save button
• destination NAT: make local-port numeric before applying range in registered firewall rule (contributed by Thomas Cheyney)
• rules: add “received-on” interface keyword as interface origin option
• rules: promote “statetype” from advanced to common option for “received-on” usage

firmware

• revoke 26.1 fingerprint

kea

• remove count badge from GroupBy with static configuration elements
• use DOM construction for the “dynamic” label

network time

• strict security GUI support

unbound

• update Hagezi blocklists to use new mirror URL

wireguard

• FreeBSD 15 no longer allows addresses without netmasks
• cleaner QR codes (contributed by Roy Orbitson)
• preserve peer generator state for existing peers

mvc

• BaseField: add getInitialValue()
• OptionField: fix simplified option group definition
• fix typo in base_form.volt advanced/help toggle IDs
• fix assorted stale imports in the code base

ui

• tabulator: add _showMaximized() modal that can show a grid close to full screen
• add keyboard shortcut “f” to maximize a currently visible grid
• scope “all help” and “advanced mode” toggle to closest relevant form

plugins

• os-caddy 2.2.1
• os-frr 1.55
• os-theme-rebellion 1.9.7 (contributed by Team Rebellion)

src

• posixshm: fix a TOCTOU race in the FIOSSHMLPGCNF handler
• tty: revalidate after dropping the tty lock in ioctl handlers
• ppp: fix multiple vulnerabilities
• openssl: fix multiple vulnerabilities
• cred: fix group_is_primary()
• dsp: fix a potential use-after-free in dsp_oss_syncstart()
• unix: fix some bugs in the SOCK_STREAM receive path
• hwpmc: fix the execve handler
• ucode: fix validation on Intel platforms
• netmap: fix driver name handling
• netmap: fix a race in kqueue registration
• e1000: assorted upstream patches from stable/15
• iflib: support recoverable initialization failure
• route: add an eventhandler for rt_numfibs changes
• rawip: fix handling of checksums in rip6_input()
• pf: attempt to handle overlapping group and interface names
• pf: check if a group has a kif before dereferencing it
• pf: fix fallout from the STATE_LOOKUP macro removal
• pf: re-optimize state key handling
• pf: rule label patch was merged from a wrong version
• pfsync: handle large MTU pfsync interfaces
• ktls: propagate EPG_FLAG_ANON to mapped mbufs
• netipsec: fix sockaddr type set in ipcomp6_nonexp_encapcheck()
• src: PF_KEY socket: limit the length of copied socket address
• ure: add USB device IDs for additional RTL8152/RTL8153 adapters
• ure: fix spurious link flaps from MII

ports

• ca_root_nss / nss 3.127
• expat 2.8.3
• kea 3.0.4
• monit 6.0.0
• openssh 10.5p1
• openssl 3.5.8
• perl 5.42.3
• phalcon 5.20.3
• php 8.5.9
• rrdtool 1.11.0
• sqlite 3.53.4

A hotfix release was issued as 26.7.3_2

• interfaces: add missing PPP support to interface_parent_devices()
• firewall: source NAT: fix faulty import removal

A hotfix release was issued as 26.7.3_8

• system: normalize output of get_nameservers()
• interfaces: prevent inline reloads of VLANs via rc.linkup
• interfaces: batch VIP post-reload for proxyarp/pfsync
• monit: use LIBXML_NOCDATA on XML fetch
• ui: improve form matching for help/advanced
• ui: fix _showMaximized() height calculation when mobile navigation triggers below 768px width

A hotfix release was issued as 25.10.2_3:

• captive portal: fix hard-timeout calculation
• firmware: avoid update-hook background cleanups
• mvc: fix CSRF vulnerability in multiple API endpoints by enforcing POST-only requests (contributed by Oliver Jueguen)
• src: file: qualify pointers to capsicum rights as const
• src: file: add a fd flag with O_RESOLVE_BENEATH semantics
• src: file: Fix the !CAPABILITIES build
• src: unix: Set O_RESOLVE_BENEATH on fds transferred between jails
• src: rtsock: Fix stack overflow

This business release is based on the OPNsense 26.1.11 community version with additional reliability improvements.

Please note that this release offers source NAT as a tentative replacement for outbound NAT. Feature parity is a work in progress for the 26.10 series. For now, please be aware that source NAT continues to work as before, but the GUI will not allow you to edit the source NAT rules unless you choose hybrid or manual mode in the settings. This aligns with how the outbound NAT page is working. Starting with 26.10, the hybrid or manual mode will be required to render source NAT rules into the firewall.

Here are the full patch notes for the initial release:

system

• improve the log_archive script to also work on log subdirectories
• routing: changed “disable” option to “enable”
• add “local_uri” type in SanitizeFilter() and use it to avoid hardcoding
• several compatible adjustments for upcoming PHP 8.5
• enhance live log widget (contributed by Greelan)
• support 7680 bit RSA type for certificates and authorities

reporting

• improve parsing in NetFlow for overlapping flow timestamps and use UTC for cleanups
• stop NetFlow service before reloading configuration

interfaces

• properly format API times to ISO format and convert timezone for display in automatic discovery
• fix typos in GIF reconfiguration script
• improve VIP page save when no subnet was posted

firewall

• use htmlSafe() on action search value in live log (reported by call-AX)
• always show automatic and legacy rules in new rules GUI
• add the same new rules GUI design to the MVC NAT pages
• add CSV download/upload to MVC NAT pages
• add migration for outbound NAT into source NAT page
• destination NAT: display effective port when local-port is omitted
• source NAT: allow empty target which means the interface address
• source NAT: skip rendering rules when mode is not advanced/manual or hybrid
• improve performance on MVC pages using virtualDOM
• allow WAN as “associated interface” for NPTv6 when prefix ID is set
• fix TypeError on alias getItem() with unknown UUID (contributed by haxorton)
• show rule counts that can be exported and hide tab if no rules exist
• improve interface filter logic to include floating rules with multiple interfaces when they overlap with at least one interface in the interface filter request
• add validations for “No RDR” option to prevent target and local-port being set
• fix some small issues in menu registration for legacy pages
• constraint source NAT getAction() to only general page and align setAction() accordingly
• scope get action to general settings in source NAT

kea

• prevent converting the decimal prefix_id using hexdec() for dynamic PD
• add widget to show DHCP leases
• simplify model option values
• improve prefix watcher accuracy via both interface and MAC address key
• store subnet IDs inside the model so they cannot shift during config regeneration
• change dynamic pool range from prefix to range 1000-2000
• switch custom DHCP option config generation to libdhcp_flex_option library

openvpn

• add some input validation for control characters in connection status (reported by lujiefsi)
• simplify model option values

unbound

• switch AAAA-only mode from respip to block_a_wdata (contributed by Maurice Walker)
• update Hagezi blocklists to use new mirror URL

mvc

• add some missing htmlSafe() calls for generated HTML (reported by lujiefsi)
• guard BaseField::setNodes() against a list given for a scalar leaf (contributed by haxorton)
• DescriptionField: disable special and newline characters
• FileObject: fix exception bug (contributed by Greelan)
• give throwReadOnly() a sibling named throwNotFullAdmin()
• use camelCase for carp_status action
• translate backend system status messages
• translate grid view labels

ui

• add some more legacy_html_escape_form_data() safeguards (reported by Arpit Jain)
• bootgrid: minor optimizations

plugins

• os-OPNDNS 1.0 is an authoritative nameserver with RFC2136 support using PowerDNS
• os-OPNWAF 2.3
• os-cloudflared 1.1
• os-freeradius 1.10.2
• os-vnstat 1.4

src

• igc: disable PCIe ASPM to improve stability
• ena: update driver version to v2.8.3
• coredump: do not assume that the number of ELF segments is consistent
• sysvsem: fix a TOCTOU race in semctl()
• wg: check for crypto operation errors
• tzdata: import 2026c

ports

• curl 8.21.0
• lighttpd 1.4.84
• openssh 10.4p1
• openvpn 2.7.6
• phalcon 5.16.0
• py-duckdb 1.5.4
• python 3.13.15
• syslog-ng 4.12.0
• unbound 1.26.0

This update addresses the WireGuard MAC authentication issue people have been talking about, 4 core security advisories and the usual volume of quality of life improvements and bug fixes.

We are currently improving the compatibility with the legacy pages in full privilege separation, working on feature parity between Outbound NAT and Source NAT and will also provide a road map in the next weeks for 27.1. Stay tuned.

Here are the full patch notes:

system

• use /var/lib/php/tmp in static pages for proper privilege separation
• improve “user-config-readonly” in static pages where write_config() was denied
• service widget changes based on further community feedback
• support 7680 bit RSA type for certificates and authorities
• add redirection capability to SSO provider

reporting

• correctly map NetFlow indexes when there are gaps (contributed by Thomas Cheyney)
• improve parsing in NetFlow for overlapping flow timestamps and use UTC for cleanups
• make parsing iftop lines more robust for traffic graphs (contributed by Brendan Bank)
• map ARC and laundry to cache memory stats (contributed by Konstantinos Spartalis)
• stop NetFlow service before reloading configuration

interfaces

• fix assignment of wireless devices
• strict description fields in new assignments page (reported by call-AX)
• fix typos in GIF reconfiguration script
• add “noclamp” flag for GIF
• add separate link types for IPv4 and IPv6 in overview
• return the proper UUID when assigning an interface (contributed by Kemoy Campbell)
• improve VIP page save when no subnet was posted

firewall

• use htmlSafe() on action search value in live log (reported by call-AX)
• group invalid rules to the end of the ruleset
• enable virtualDOM and refactor commands on alias page
• add “endpoint-independent” support for UDP translations (full cone NAT) in source NAT
• fix missing well-known ports in local-port in destination NAT
• add “max-pkt-rate” rate limiting option to firewall rules
• add proper support for container items in search field selection, export and import data and implement it in destination NAT
• scope get action to general settings in source NAT

kea

• improve prefix watcher accuracy via both interface and MAC address key
• store subnet IDs inside the model so they cannot shift during config regeneration
• change dynamic pool range from prefix to range 1000-2000
• switch custom DHCP option config generation to libdhcp_flex_option library

openvpn

• add some input validation for control characters in connection status (reported by lujiefsi)

backend

• sanitize template filename replacements
• further restrict actions to root and wwwonly for more sensitive actions
• ensure strict templates are not reloaded via “*” wildcard

mvc

• add some missing htmlSafe() calls for generated HTML (reported by lujiefsi)
• create runInterfaceRegistation() and use it for immediate device registration
• add some exception types and handle them in the base template
• clean up a number of stale imports
• translate backend system status messages
• translate grid view labels

ui

• add some more legacy_html_escape_form_data() safeguards (reported by Arpit Jain)
• add tokenize2.css in standard theme to ensure selection in opnsense-auto theme
• prevent blinking by hiding the contents while loading for opnsense-auto theme
• fix collapsed sidebar stray line and restore rail divider in opnsense-dark theme (contributed by circa1665)
• restore stacked layout for interfaces widget on narrow (contributed by circa1665)
• fix minor JavaScript bugs in dashboard widget code (contributed by Thomas Schöpf)
• do not freeze commands column on touchscreen devices
• further fixes for base templates
• fix empty legacy firewall menu container glitch

plugins

• os-caddy 2.2.0
• os-frr 1.54
• os-intrusion-detection-content-at-antiphishing 1.0 (contributed by Julio Lira)
• os-ndp-proxy-go 1.4
• os-nrpe 1.2
• os-theme-rebellion 1.9.6 (contributed by Team Rebellion)

src

• pf: add missing PF_TS_CNT netlink attribute
• pf: expose first rule label for states since rule number is insufficient
• usb: bpfattach() before if_attach()
• igc: disable PCIe ASPM to improve stability
• ena: update driver version to v2.8.4
• assorted minor commits from stable/15
• coredump: do not assume that the number of ELF segments is consistent
• sysvsem: fix a TOCTOU race in semctl()
• jail: restore ktrace privileges for jailed root
• ktimer: check for errors from realtimer_gettime()
• kqueue: avoid enqueuing an already-enqueued knote
• zfs: multiple fixes
• tzdata: import 2026c
• wg: check for crypto operation errors
• revert “daemon: replace memchr with memrchr”

ports

• dpinger 3.6
• hostapd / wpa_supplicant 2.12
• nss 3.126
• openldap 2.6.14
• openssh 10.4p1
• openvpn 2.7.6
• phalcon 5.18.2
• py-duckdb 1.5.5
• python 3.13.15
• unbound 1.26.0

This is a small stable release addressing some of the upgrade related issues that were reported last week as well as 4 new security advisories for the core code.

Here are the full patch notes:

• system: add correct release name to boot splash screen for 26.7
• system: disable web GUI KTLS use for the time being
• system: do not let the components selectpicker grow indefinitely in defaults page
• system: DTLSv1.1 is forcefully rejected by OpenSSL 3.5, migrate to DTLSv1.2
• system: use Bootstrap “btn” styles in services widget
• system: use serialNumberHex for CRL so high-bit serials are not dropped (contributed by chrstnth)
• system: lower max-request-size to roughly max post size in lighttpd configs (reported by lujiefsi)
• system: fixed several PHP 8.5 warnings
• firewall: use “urgent” as empty default for firewall debug messages
• firewall: skip message banner if searchPhrase set
• firewall: fix PHP warning when scrub yields no interfaces
• captive portal: automatic block rule should be evaluated after the anti-lockout rule
• openvpn: client export can export private keys for unlisted certificate references (reported by iys8 and lujiefsi)
• backend: remove cache file on execution error in script_output
• mvc: fix tab/subtab form generation for plugins
• mvc: fix default labels in selectpickers
• mvc: form labels can be empty so make sure to add them to avoid warnings in forms
• mvc: safeguard some write operations with missing throwReadOnly() actions for custom action (reported by lujiefsi)
• ui: fix multiple stored XSS (reported by lujiefsi)
• plugins: os-theme-rebellion 1.9.5 (contributed by Team Rebellion)
• ports: ca_root_nss / nss 3.125

A hotfix release was issued as 26.7.1_1:

• system: fix default gateway switch alarm trigger being overwritten by gateway group check
• ports: pecl-mcrypt 1.0.9

For over 11 a half years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, fast adoption of upstream software updates, modern IPv6 support, as well as clear and stable 2-Clause BSD licensing.

26.7, nicknamed “Xenial Xenops”, features interface assignments and gateway groups via MVC/API, firewall rules now defaulting to MVC/API, outbound NAT to source NAT migration assistant, captive portal IPv6 support, Kea DDNS/custom options/dynamic prefix delegation, FreeBSD 15.1, OpenVPN 2.7, PHP 8.5, Python 3.13, plus much more.

The upgrade path for 26.1 will likely be unlocked later today. We want to ensure the upgrade goes as smoothly as possible so please be patient! :)

Download links, an installation guide and the checksums for the images can be found below as well.

Europe:
US East Coast:
US West Coast:
South America:
East Asia:
Full mirror list:

Here are the full patch notes:

• system: remove periodic backups settings and backend code
• system: migrate gateway groups to MVC/API
• system: new service widget flat tile layout (partially contributed by Konstantinos Spartalis)
• system: make LDAP auth adhere to bad login penalty as well (contributed by Matt Andreko)
• system: move ldap_escape() to caller for now to avoid side effects
• system: improve the log_archive script to also work on log subdirectories
• system: change our version of “certctl” to emit files instead of links like it is the case in FreeBSD 15.1
• system: include interfaces widget in dashboard default
• system: adjust dashboard widget resize logic to observe border box instead of content box
• reporting: migrate several settings pages to MVC/API and assorted changes
• reporting: do not show disabled interfaces in traffic graphs (contributed by Konstantinos Spartalis)
• interfaces: migrate interface assignments to MVC/API
• interfaces: fix faulty netmask on loopback address due to upstream change
• firmware: remove overzealous cleansing in output_cmd to unhide individual character progress
• firewall: move config.xml default LAN allow rules to new rules GUI
• firewall: legacy rules pages move to plugin
• firewall: restrict automatic DHCPv6 filter rules to plugin/track6 use
• firewall: always set a sequence at the end of the rule set when cloning a NAT rule
• firewall: remove unused “safepoint” actions
• firewall: fix automatic source NAT rules not displayed for PPPoE interfaces
• firewall: flatten automatic source NAT rules into two per WAN type interface
• firewall: prevent deletion if a group is referenced in MVC rules
• captive portal: move template actions out of the ServiceController into its own TemplateController
• dnsmasq: possible use before define in lease watcher
• intrusion detection: rename “uncategorized” rule package to “adult” (contributed by Konstantinos Spartalis)
• unbound: missing NetMaskAllowed=N on override address
• wireguard: add allowed-ips to reresolve-dns.py in case none are set yet
• acl: merge user management ACLs into one single privilege
• backend: allow “strict” mode +TARGETS using the preamble “!”
• backend: swap “strict” template logic as it was reversed
• mvc: refactor base_dialog and parseFormNode() to simplify the template
• mvc: remove unused argument from getFormGrid()
• mvc: BaseField: emit descriptions in getNodes() when they are not the same as the value to match getNodeContent()
• mvc: PortField: reject whitespaces in port ranges during validation
• mvc: ModelRelationField: remove grouped option handling
• ui: add “opnsense-auto” theme which switches between “opnsense” and “opnsense-dark” depending on browser setting
• ui: decrease flashing in opnsense-auto theme when switching (contributed by Konstantinos Spartalis)
• ui: remove direct apply_btn_id usage in favour of base_apply_button template partial
• ui: fix menu registration not setting “active”
• plugins: os-firewall-legacy 1.0 contains the static PHP firewall rules pages
• plugins: os-ndproxy has been removed, use os-ndp-proxy-go instead
• src: FreeBSD 15.1-RELEASE-p1 plus assorted stable/15 networking commits
• src: pf: do not mangle IP header before shared forwarding
• src: pf: stop resolving hosts via DNS that use “:” modifier
• src: pf: clear anchor after stepping into it in pf_match_translation_rule()
• src: pf: pf_route() “dst” no longer holds the gateway in 15.x
• ports: libevent 2.1.13
• ports: lighttpd 1.4.85
• ports: openvpn 2.7.5
• ports: sqlite 3.53.3
• ports: suricata 8.0.6

Migration notes, known issues and limitations:

• The privileges “page-system-groupmanager” and “page-system-usermanager-addprivs” were merged into “page-system-groupmanager” and are no longer available separately. This was done to avoid the misconception that access to a user management page gives constrained rights to each page, but that is not the case. User management is a process involving all 3 pages.
• The static PHP pages for firewall rule management have been moved to the “os-firewall-legacy” plugin which can be manually installed before or after the upgrade. All rules will continue to work regardless of the plugin being installed or not and are easily migrated using the given assistant.
• Hyper-V guests may be producing panics on certain hosts with more than one virtual processor assigned. Make sure to snapshot beforehand and stay on 26.1.x until the situation is clear.
• Since this is a major OS upgrade and OpenSSL changes from 3.0 to 3.5 third party repositories may interfere with your upgrade experience. Removing offending repositories and plugins may help; or wait for affirmation from the respective repository owners.
• The CPU microcode early loading has been known to be flaky on some setups. A fix is in the FreeBSD 15.1 boot loader code, but can only be reached by reinstall or manually updating the boot code of your system after the upgrade succeeded. If you want to be on the safe side during the upgrade itself please remove the plugin before proceeding.

The public key for the 26.7 series is:

# -----BEGIN PUBLIC KEY-----
# MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAziSNKuzrL2cwLx5LXmLn
# cWS5Lk+i9CzRMXO/4xQYBQCaSnd8GBg/HA/g4aPoTUa6ovAI0AHfW8KQJQyBkFzn
# pi6MLZJ9tEaFcn0CiV+tSTJd1RV4bB8jtpKl5oTkgFrPsyaB7iBlG5Cd49VCW19h
# DxClQ24lkWkVoYfsfCQEt4ADNGLygWCPyf4bxGD/t6/tiW9SsOs2+gfOZ9C/G2d/
# EBhJFoBEoz5lvULVxTdfY5PScYrHD/waZnk3rGc2A+9pI/SM2JAwKqsgZ6MSFbXO
# DNocSjqFUUkdqhty+Qcc0OJ+hMbKKVE+f3QJBQIwT3ayys8QK0m5CCo91/f+DjoN
# noj+t5YN9x8GREkF0wrdIi7hevkwrL2/SJQbq1bL1BLB+mMSXYR611lgT8YfYjyZ
# 7tmpNVC3O5Pj7l20snm1lVUSqS0PsFBvh6HQtBRwQDGppaIIhH1Nt9yIatmSiGZt
# 2YrMVNBzbQrJzSX+vWcAulkaPIt4t+XxmpO5IDNZ+4uMZ7XyJq1lAhIeyXx+Falf
# v7S+ZpJWFVNz0/N5z6lBbADD855i+gFY6B5209xGyhd6FwaPOjISgQKkgBwF1AiW
# MDuTuP9lkh/U5gGBZIFTnbdEMgOAL4P+Hsw9Nozav+3QIpiU3Pv9F29a1erCkq09
# rpQyNglY7Jqme/RipzbYia8CAwEAAQ==
# -----END PUBLIC KEY-----

Stay safe, .. code-block:

# SHA256 (OPNsense-26.7-dvd-amd64.iso.bz2) = 95cafedda6d5b22ce832e249dc2309110fbee19f813ad78cf28bb3d387186bfb
# SHA256 (OPNsense-26.7-nano-amd64.img.bz2) = 28d5e2f37e40d87468a924e3006ef10e2ddc6de485b85333d9e3958c84d0cb9d
# SHA256 (OPNsense-26.7-serial-amd64.img.bz2) = 259b441646f1b0d77075a7281e368fe7f4c980360498ed6bc23740bd83c67e32
# SHA256 (OPNsense-26.7-vga-amd64.img.bz2) = d975ed876e0650f6a5bf30b2e97218c5eaa370bef6597b19f43e22c1b950d3fc

Summer challenges aside: 26.7 is almost here! It includes FreeBSD 15.1 and a somewhat small list of other highlights. The reason for that is a stringent backporting strategy that was employed in the 26.1 series.

Keep in mind this is an online-based pre-production test release. Upgrades from the 26.1.11 development version are already available. The final release date for 26.7 is July 15.

Here are the development highlights since version 26.1 came out:

• Interfaces assignments to MVC/API
• Gateway groups to MVC/API
• Firewall rules MVC page is now the default
• Source NAT is now a replacement for outbound NAT
• Captive portal IPv6 support
• Kea DDNS, custom options and dynamic prefix delegation support
• OpenVPN 2.7 with TLS-Crypt v2 support
• FreeBSD 15.1
• Python 3.13
• PHP 8.5

And these are the changes against version 26.7-RC1:

• system: include interfaces widget in dashboard default
• firewall: constraint source NAT getAction() to only general page and align setAction() accordingly
• firewall: use proper path for one-to-one NAT rules for renaming operations
• firewall: avoid emitting reply-to on block rules as well
• captive portal: adjust accounting interval to Acct-Interim-Interval
• firmware: remove overzealous cleansing in output_cmd to unhide individual character progress
• monit: fix mail-format and poll-time validation
• mvc: add file type to forms
• ports: suricata 8.0.6

A hotfix release was issued as 26.7.r2_3:

• interfaces: fix faulty netmask on loopback address due to upstream change
• firewall: change interface group render/apply order
• backend: swap “strict” template logic as it was reversed
• src: pf: do not mangle IP header before shared forwarding
• src: additional stable/15 networking patches

Summer challenges aside: 26.7 is almost here!

It includes FreeBSD 15.1 and a somewhat small list of other highlights. The reason for that is a stringent backporting strategy that was employed in the 26.1 series.

Keep in mind this is mostly an image-based pre-production test release. Upgrades from the 26.1.11 development version will be available later this week. An online-only RC2 will probably follow as well. The final release date for 26.7 is July 15.

Here are the development highlights since version 26.1 came out:

• Interfaces assignments to MVC/API
• Gateway groups to MVC/API
• Firewall rules MVC page is now the default
• Source NAT is now a replacement for outbound NAT
• Captive portal IPv6 support
• Kea DDNS, custom options and dynamic prefix delegation support
• OpenVPN 2.7 with TLS-Crypt v2 support
• FreeBSD 15.1
• Python 3.13
• PHP 8.5

And these are the changes against version 26.1.11:

• system: remove periodic backups settings and backend code
• system: migrate gateway groups to MVC/API
• system: new service widget flat tile layout (partially contributed by Konstantinos Spartalis)
• system: make LDAP auth adhere to bad login penalty as well (contributed by Matt Andreko)
• system: move ldap_escape() to caller for now to avoid side effects
• system: improve the log_archive script to also work on log subdirectories
• system: change our version of “certctl” to emit files instead of links like it is the case in FreeBSD 15.1
• reporting: migrate several settings pages to MVC/API and assorted changes
• interfaces: migrate interface assignments to MVC/API
• firewall: move config.xml default LAN allow rules to new rules GUI
• firewall: legacy rules pages move to plugin
• firewall: restrict automatic DHCPv6 filter rules to plugin/track6 use
• firewall: always set a sequence at the end of the rule set when cloning a NAT rule
• firewall: remove unused “safepoint” actions
• firewall: fix automatic source NAT rules not displayed for PPPoE interfaces
• firewall: flatten automatic source NAT rules into two per WAN type interface
• firewall: prevent deletion if a group is referenced in MVC rules
• captive portal: move template actions out of the ServiceController into its own TemplateController
• dnsmasq: possible use before define in lease watcher
• intrusion detection: rename “uncategorized” rule package to “adult” (contributed by Konstantinos Spartalis)
• unbound: missing NetMaskAllowed=N on override address
• wireguard: add allowed-ips to reresolve-dns.py in case none are set yet
• acl: merge user management ACLs into one single privilege
• backend: allow “strict” mode +TARGETS using the preamble “!”
• backend: swap “strict” template logic as it was reversed
• mvc: refactor base_dialog and parseFormNode() to simplify the template
• mvc: remove unused argument from getFormGrid()
• mvc: BaseField: emit descriptions in getNodes() when they are not the same as the value to match getNodeContent()
• mvc: PortField: reject whitespaces in port ranges during validation
• mvc: ModelRelationField: remove grouped option handling
• ui: add “opnsense-auto” theme which switches between “opnsense” and “opnsense-dark” depending on browser setting
• ui: decrease flashing in opnsense-auto theme when switching (contributed by Konstantinos Spartalis)
• ui: remove direct apply_btn_id usage in favour of base_apply_button template partial
• ui: fix menu registration not setting “active”
• plugins: os-firewall-legacy 1.0 contains the static PHP firewall rules pages
• plugins: os-ndproxy has been removed, use os-ndp-proxy-go instead
• src: FreeBSD 15.1-RELEASE-p1 plus assorted stable/15 networking commits
• ports: libevent 2.1.13
• ports: openvpn 2.7.5
• ports: sqlite 3.53.3

Migration notes, known issues and limitations:

• The privileges “page-system-groupmanager” and “page-system-usermanager-addprivs” were merged into “page-system-groupmanager” and are no longer available separately. This was done to avoid the misconception that access to a user management page gives constrained rights to each page, but that is not the case. User management is a process involving all 3 pages.
• The static PHP pages for firewall rule management have been moved to the “os-firewall-legacy” plugin that can be optionally installed. Note that the upgrade will not install it as rules will continue to work and are easily migrated using the given assistant.

The public key for the 26.7 series is:

# -----BEGIN PUBLIC KEY-----
# MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAziSNKuzrL2cwLx5LXmLn
# cWS5Lk+i9CzRMXO/4xQYBQCaSnd8GBg/HA/g4aPoTUa6ovAI0AHfW8KQJQyBkFzn
# pi6MLZJ9tEaFcn0CiV+tSTJd1RV4bB8jtpKl5oTkgFrPsyaB7iBlG5Cd49VCW19h
# DxClQ24lkWkVoYfsfCQEt4ADNGLygWCPyf4bxGD/t6/tiW9SsOs2+gfOZ9C/G2d/
# EBhJFoBEoz5lvULVxTdfY5PScYrHD/waZnk3rGc2A+9pI/SM2JAwKqsgZ6MSFbXO
# DNocSjqFUUkdqhty+Qcc0OJ+hMbKKVE+f3QJBQIwT3ayys8QK0m5CCo91/f+DjoN
# noj+t5YN9x8GREkF0wrdIi7hevkwrL2/SJQbq1bL1BLB+mMSXYR611lgT8YfYjyZ
# 7tmpNVC3O5Pj7l20snm1lVUSqS0PsFBvh6HQtBRwQDGppaIIhH1Nt9yIatmSiGZt
# 2YrMVNBzbQrJzSX+vWcAulkaPIt4t+XxmpO5IDNZ+4uMZ7XyJq1lAhIeyXx+Falf
# v7S+ZpJWFVNz0/N5z6lBbADD855i+gFY6B5209xGyhd6FwaPOjISgQKkgBwF1AiW
# MDuTuP9lkh/U5gGBZIFTnbdEMgOAL4P+Hsw9Nozav+3QIpiU3Pv9F29a1erCkq09
# rpQyNglY7Jqme/RipzbYia8CAwEAAQ==
# -----END PUBLIC KEY-----

Please let us know about your experience!

SHA256 (OPNsense-26.7.r1-dvd-amd64.iso.bz2) = 6b8430921316bd1d912a7bf71d02f2e354cd82b644c3fbf2646ab55382b9a758

SHA256 (OPNsense-26.7.r1-nano-amd64.img.bz2) = 1b95ab4cafaa195272b2b9d7ac3f42015c277b918818f535851c8c3206c5829d

SHA256 (OPNsense-26.7.r1-serial-amd64.img.bz2) = 0db5557508f088e513436f6f7ad5c37f42c6614ce50a34595523890cded7c336

SHA256 (OPNsense-26.7.r1-vga-amd64.img.bz2) = 2e352fd8628e742dd0637a8f84768f607b3ad45a4491a77d9623b4976ac6931b