OPNsense Business Edition Updates & Release Notes

A hotfix release was issued as 21.4.3_8:

• system: prevent expired or intermediate CA certificates from being added to trust store by default
• system: fix unescaped source field used for password in backup plugins
• firewall: fix long comment preventing IPFW reload (contributed by Robin Schneider)
• firmware: enable upgrade path to 21.10
• firmware: undo masking vulnerability URLs in FreeBSD due to UUID use
• firmware: correctly announce major upgrade reboot in status return
• firmware: do not fetch GeoIP database from business mirrors without a subscription
• backend: catch broken pipe on event handler (contributed by kulikov-a)

Original source

A hotfix release was issued as 25.10.2_3:

• captive portal: fix hard-timeout calculation
• firmware: avoid update-hook background cleanups
• mvc: fix CSRF vulnerability in multiple API endpoints by enforcing POST-only requests (contributed by Oliver Jueguen)
• src: file: qualify pointers to capsicum rights as const
• src: file: add a fd flag with O_RESOLVE_BENEATH semantics
• src: file: Fix the !CAPABILITIES build
• src: unix: Set O_RESOLVE_BENEATH on fds transferred between jails
• src: rtsock: Fix stack overflow

Original source

This business release is based on the OPNsense 26.1.11 community version with additional reliability improvements.

Please note that this release offers source NAT as a tentative replacement for outbound NAT. Feature parity is a work in progress for the 26.10 series. For now, please be aware that source NAT continues to work as before, but the GUI will not allow you to edit the source NAT rules unless you choose hybrid or manual mode in the settings. This aligns with how the outbound NAT page is working. Starting with 26.10, the hybrid or manual mode will be required to render source NAT rules into the firewall.

Full patch notes for the initial release

• system: improve the log_archive script to also work on log subdirectories
• system: routing: changed “disable” option to “enable”
• system: add “local_uri” type in SanitizeFilter() and use it to avoid hardcoding
• system: several compatible adjustments for upcoming PHP 8.5
• system: enhance live log widget (contributed by Greelan)
• system: support 7680 bit RSA type for certificates and authorities
• reporting: improve parsing in NetFlow for overlapping flow timestamps and use UTC for cleanups
• reporting: stop NetFlow service before reloading configuration
• interfaces: properly format API times to ISO format and convert timezone for display in automatic discovery
• interfaces: fix typos in GIF reconfiguration script
• interfaces: improve VIP page save when no subnet was posted
• firewall: use htmlSafe() on action search value in live log (reported by call-AX)
• firewall: always show automatic and legacy rules in new rules GUI
• firewall: add the same new rules GUI design to the MVC NAT pages
• firewall: add CSV download/upload to MVC NAT pages
• firewall: add migration for outbound NAT into source NAT page
• firewall: destination NAT: display effective port when local-port is omitted
• firewall: source NAT: allow empty target which means the interface address
• firewall: source NAT: skip rendering rules when mode is not advanced/manual or hybrid
• firewall: improve performance on MVC pages using virtualDOM
• firewall: allow WAN as “associated interface” for NPTv6 when prefix ID is set
• firewall: fix TypeError on alias getItem() with unknown UUID (contributed by haxorton)
• firewall: show rule counts that can be exported and hide tab if no rules exist
• firewall: improve interface filter logic to include floating rules with multiple interfaces when they overlap with at least one interface in the interface filter request
• firewall: add validations for “No RDR” option to prevent target and local-port being set
• firewall: fix some small issues in menu registration for legacy pages
• firewall: constraint source NAT getAction() to only general page and align setAction() accordingly
• firewall: scope get action to general settings in source NAT
• kea: prevent converting the decimal prefix_id using hexdec() for dynamic PD
• kea: add widget to show DHCP leases
• kea: simplify model option values
• kea: improve prefix watcher accuracy via both interface and MAC address key
• kea: store subnet IDs inside the model so they cannot shift during config regeneration
• kea: change dynamic pool range from prefix to range 1000-2000
• kea: switch custom DHCP option config generation to libdhcp_flex_option library
• openvpn: add some input validation for control characters in connection status (reported by lujiefsi)
• openvpn: simplify model option values
• unbound: switch AAAA-only mode from respip to block_a_wdata (contributed by Maurice Walker)
• unbound: update Hagezi blocklists to use new mirror URL
• mvc: add some missing htmlSafe() calls for generated HTML (reported by lujiefsi)
• mvc: guard BaseField::setNodes() against a list given for a scalar leaf (contributed by haxorton)
• mvc: DescriptionField: disable special and newline characters
• mvc: FileObject: fix exception bug (contributed by Greelan)
• mvc: give throwReadOnly() a sibling named throwNotFullAdmin()
• mvc: use camelCase for carp_status action
• mvc: translate backend system status messages
• mvc: translate grid view labels
• ui: add some more legacy_html_escape_form_data() safeguards (reported by Arpit Jain)
• ui: bootgrid: minor optimizations
• plugins: os-OPNDNS 1.0 is an authoritative nameserver with RFC2136 support using PowerDNS
• plugins: os-OPNWAF 2.3
• plugins: os-cloudflared 1.1
• plugins: os-freeradius 1.10.2
• plugins: os-vnstat 1.4
• src: igc: disable PCIe ASPM to improve stability
• src: ena: update driver version to v2.8.3
• src: coredump: do not assume that the number of ELF segments is consistent
• src: sysvsem: fix a TOCTOU race in semctl()
• src: wg: check for crypto operation errors
• src: tzdata: import 2026c
• ports: curl 8.21.0
• ports: lighttpd 1.4.84
• ports: openssh 10.4p1
• ports: openvpn 2.7.6
• ports: phalcon 5.16.0
• ports: py-duckdb 1.5.4
• ports: python 3.13.15
• ports: syslog-ng 4.12.0
• ports: unbound 1.26.0

Full patch notes for patch release 1

• system: audit log injection via login username in auth_log()
• system: offer post-quantum mldsa44-ed25519 OpenSSH server host key
• system: do not regenerate all OpenSSH key files when adding new key types
• system: use created user name for change event (contributed by Julian Pawlowski)
• system: fix server certificate purpose detection for EC
• system: approximate user being expired for the grid view icon
• firewall: remove 2a10::/12 from bogonsv6.sample (contributed by Belgarion)
• captive portal: exclude IPv4 from roaming logic
• plugins: os-OPNWAF 2.4
• src: posixshm: fix a TOCTOU race in the FIOSSHMLPGCNF handler
• src: tty: revalidate after dropping the tty lock in ioctl handlers
• src: ppp: fix multiple vulnerabilities
• src: openssl: fix more vulnerabilities
• src: dsp: fix a potential use-after-free in dsp_oss_syncstart()
• src: hwpmc: fix the execve handler
• src: ucode: fix validation on Intel platforms
• ports: openssh 10.5p1
• ports: openssl 3.0.22
• ports: openvpn 2.7.7

Full patch notes for patch release 2

• system: make compare operator in authTOTP() more strict
• interfaces: ppp-ipv6.php may be executed before later stages of interface_configure()
• ipsec: add some hybrid post-quantum variants as additional key exchange
• acl: fix API patters for GIF/GRE device settings
• acl: add missing and fix some issues (contributed by Konstantinos Spartalis)
• rc: add watchdog to shutdown, reboot and reload_all cases
• ports: strongswan 6.1.0
• ports: suricata 8.0.7
• ports: unbound 1.26.1

Full patch notes for patch release 3

• system: clear password change session flag only after password was changed (reported by Wu Wenhao)
• system: use correct type for IP when killing active states in “lockout_handler” (reported by Omar Habra of Apex Security Research)
• system: fix HA service restart with “id” parameter set
• interfaces: dhclient handles keywords case-insensitive so properly match all “media” invokes (reported by Alice-Sabrina-Ivy)
• interfaces: stricter archive command in backend for packet capture download
• firewall: fix expiry cron job default when alias TTL is smaller than 1 hour
• plugins: os-OPNBEcore 1.9
• plugins: os-OPNWAF 2.5
• src: sysvsem: heap out-of-bounds access in semop(2)
• src: ktls: remote DoS via receive-side kernel TLS
• src: udp: IPv6 UDP sendto(2) bypasses jail loopback restriction
• src: vfs: multiple jail filesystem root escapes
• src: openssl: out-of-bounds read in OpenSSL DTLS retransmission
• ports: expat 2.8.5

Original source

This business release is based on the OPNsense 26.1.9 community version with additional reliability improvements.

Here are the full patch notes for the initial release:

• system: refactor dashboard to use User model instead of direct config access
• system: throw UserException when dashboard size limit was reached on save
• system: add notes dashboard widget (contributed by Konstantinos Spartalis)
• system: fix traffic dashboard widget initialization race condition (contributed by Greelan)
• system: avoid side effect rendering sysctl item in config.xml during console assignment
• system: improve cron command and parameter escaping
• system: support RADIUS NAS-IP-Address attribute for authentication
• system: add compatibility layer to future route disable/enable migration
• system: only split first colon when reading sysctls
• system: revisit snapshot name validation (partially contributed by Konstantinos Spartalis)
• system: fix missing newline when generating cron jobs due to a regression
• system: fix missing base64_decode() in JsonField which prevented user settings from saving
• system: link CA references after all changes
• system: parse certificate “key_type” and “digest”
• system: allow flushing legacy OpenVPN legacy config
• system: audit “staticroute” config access
• system: use safe config iteration in core_user_changed_groups()
• system: tighten landing page redirect (contributed by Konstantinos Spartalis)
• system: fix passing null into getRealInterface()
• system: fix regression in selective group delete introduced previously
• system: allow unregistered plugin cron actions to be deleted
• system: disable MAILTO for cron jobs
• system: dashboard: explicitly compact on layout shift if there is no predefined layout
• system: dashboard: update result on default restore
• reporting: render NaN values as empty values and omit leading empty records from data set for health graphs
• reporting: add max on Y axis for traffic graphs
• interfaces: refactor bridge reconfigure script
• interfaces: add missing config locks in device controllers
• interfaces: use safe iteration in backend code
• interfaces: adjust and annotate interface_dhcpv6_id()
• interfaces: account for multiple UUIDs in VIP deletion
• interfaces: more safe iteration through config_read_array()
• interfaces: fix wrong DUID-UUID format but keep accepting the wrong one
• interfaces: fix regression in selective device delete introduced previously
• interfaces: IAID selection and prefix range reservation for WAN DHCPv6
• interfaces: parse ifconfig output despite exit error in legacy_interfaces_details()
• interfaces: hostwatch: pin warning banner to enabled flag
• firewall: live view: decode HTML where necessary to aid filtering
• firewall: use save method from ApiMutableModelControllerBase for log command, move rule command and savepoint action
• firewall: safe config access in list_legacy_rules.php
• firewall: remove duplicated CSV button hook
• firewall: fix NPTv6 validation for empty external subnet
• firewall: make getRealInterface() a static utility function
• firewall: refactor searchRuleAction() to use the same filtering and sorting logic on MVC and legacy data
• firewall: fix inverted source/destination cosmetic issue in SNAT and One-to-One NAT grids
• firewall: fix search for floating rules in new rules GUI
• firewall: add an alias formatter to show content fields as “dynamic” when populated by other components
• firewall: fix Tabulator regression with alias batch delete
• firewall: use safe config iteration in interface registration
• firewall: fix unintended change in filtering logic for new rules GUI
• firewall: fix action, ipprotocol and protocol translations for legacy rules in new rules GUI
• firewall: use safe iteration over rules in filter_core_rules_user()
• firewall: add missing exclamation mark for “not” in scrub rules
• firewall: fix interface sorting by value for live log and groups
• firewall: add banner if no rules defined in new rules GUI to match legacy GUI
• firewall: use strnatcasecmp() for interface list in new rules GUI
• firewall: fix typo that prevented queues to be selectable in pf-based traffic shaping
• firewall: escape shaper targets in rule edit (contributed by lujiefsi)
• captive portal: remove redirection on HTTPS and ditch non-functional pass statement
• dnsmasq: change DHCP tag to DescriptionField
• dnsmasq: change widget link from settings to leases page
• firmware: opnsense-bootstrap: add “-B” bare bootstrap mode
• firmware: add repo configuration output to connectivity audit
• firmware: stop buffering in sed to fix chunked update log output
• firmware: retain ordering in update servers for connectivity check
• firmware: allow “local” business mirror subscription
• firmware: put clickable trailer for community plugins
• firmware: fix return value masking during updates
• firmware: opnsense-update: do not clean obsolete files on manual -r invokes
• intrusion detection: fix drop and alert buttons on rules tab
• ipsec: move swanctl.conf download button to the tab
• ipsec: restyle the connections page for clarity
• ipsec: disable scroll in authentication and children grids (contributed by Konstantinos Spartalis)
• ipsec: validate the use of refid in CA certificates (reported by lujiefsi)
• kea: fix “Delegated length must be longer than or equal to prefix length” validation
• kea: add ddns-override-no-update, ddns-override-client-update and ddns-update-on-renew per subnet
• kea: DDNS DNS server port can now be specified
• kea: add explicit reverse DDNS zones support (contributed by XtraLarge)
• kea: add DDNS manual config override
• kea: remove depend constraint of ddns_reverse_zone
• kea: plug socket into dynamic PD route installation script
• kea: add prefix to reservations to allow for static PD allocations based on DUID/MAC
• kea: infer IPv6 lease type in delete script via lease lookup so IA_NA/IA_PD can be deleted
• kea: DDNS add ddns-conflict-resolution-mode per subnet (contributed by chaispaquichui)
• kea: allow customizing “mac_sources” and change default to “ipv6-link-local”
• kea: add user-context object to config to emit description
• kea: fix option_data_autocollect mismatch in DHCPv6 page
• kea: enable internalModelSafeDelete due to increased model relation field usage
• kea: build reservation status from control socket output
• kea: add subnet vltime (partially contributed by Brandan Giles)
• kea: add client-id to DHCPv4 reservations
• kea: use JSON_UNESCAPED_UNICODE when writing the JSON configuration
• kea: dynamic prefix delegation support (reported by lujiefsi)
• kea: always start the prefix watcher when DHCPv6 is enabled
• kea: cleanups for IntegerField using isSet() and no negative numbers allowed
• network time: small cleanups in ntpd_configure_gps()
• openvpn: add tls-crypt-v2 support
• openvpn: allow restart action via cron
• openvpn: fix client export not showing common names
• openvpn: require an integer of at least 1 for “vpnid” field
• radvd: allow user controlled hop limit (contributed by BPplays)
• radvd: allow to start a manual configuration without primary IPv6
• unbound: improve hostname/domain override validation
• unbound: minor style/refactor for safe config access
• unbound: hide unused tree row in form output for overrides
• unbound: restyle statistics page
• unbound: blocklists categorization and apply button message update (contributed by Konstantinos Spartalis)
• wireguard: use getValues() consistently in control script
• acl: some missing references and using camelCase pointers instead of snake_case
• backend: configctl: properly quote parameters to avoid skipping empty ones (contributed by Majx)
• backend: configctl: support -f cache flush parameter to fix cache invalidation preamble “!” pass
• lang: numerous updates and fixes in existing languages
• mvc: introduce JSON field type and refactor dashboard to use it
• mvc: fixed a number of class import statements
• mvc: remove unused UIModelGrid imports in IDS, Monit and Syslog controllers
• mvc: remove Util imports where not needed
• mvc: BaseField: add count() helper
• mvc: fix validation to use getValue instead of plain string cast
• mvc: UIModelGrid: remove flatten() method as getFlatNodes() is almost the same
• mvc: add support for pluggable dynamic menu items and move some existing parts out of the MenuSystem class
• mvc: stricter email address validation
• mvc: OptionsField: use key as value if no value is set
• mvc: unify migration message returns
• mvc: add new validators to TextField: AllowSpaces, AllowNewlines, AllowSpecial and introduce new StrictTextField
• mvc: strict alphanumeric-only regex for certificate refid (contributed by eev4n)
• mvc: simplify assorted option values to reduce duplication
• mvc: static header support for forms
• rc: move system_powerd_configure() to bootup plugin hook
• shell: config access refactor in password and setaddr scripts
• shell: safe iteration for VLAN/LAGG in port assignment
• shell: use safe config iteration in live mode banner
• shell: fix syntax error in port assignment
• ui: generalize placeholders between controllers and JS
• ui: simplify and clean up debounce() usage
• ui: trap generic error popup for specific API URLs such as /api/core/firmware/upgradestatus when it adds no value and known to be unstable
• ui: add static dialog header support and fix bool/string compare
• ui: add type_formatter keyword to form rendering
• ui: add save/cancel button support to form rendering
• ui: remove “event” use from bootgrid showSaveAlert()
• ui: add support for binary file uploads
• ui: bootgrid: onRendered executed in wrong spot
• ui: clean up useRequestHandlerOnGet usage
• ui: use space in apply box for the apply reminder
• ui: tab exclusion for SimpleActionButton
• ui: split form button row render as some forms only use save
• ui: override selectpicker defaults for translations
• ui: hide apply button for specific tabs on multiple pages (contributed by Konstantinos Spartalis)
• ui: bootgrid: align datakey with the rest of the options, but allow top-level placement
• ui: bootgrid: mark state variables as such
• ui: bootgrid: safeguard replace() function
• ui: bootgrid: remove unused getTotalRowCount() method
• ui: bootgrid: prevent NaN pagination values for non-ajax grids when row count is set to all
• ui: bootgrid: clean up converter compatibility code
• ui: bootgrid: replace “append” with “replace” for ajax: false grids
• ui: bootgrid: adjust column persistence behavior to prevent horizontal dead space
• ui: bootgrid: allow column selection exclusions
• ui: allow passing of data attributes for select items in setFormData()
• ui: remove banner on inline reload if applicable
• ui: button padding when injecting next to apply button
• ui: fix spurious padding in apply button section (contributed by Konstantinos Spartalis)
• plugins: os-cloudflared 1.0 (contributed by Richard Aspden)
• plugins: os-ddclient 1.31
• plugins: os-frr 1.53
• plugins: os-netbird 1.3
• plugins: os-q-feeds-connector 1.6
• plugins: os-rfc2136 1.10
• plugins: os-stunnel fix for missing include in script
• plugins: os-telegraf 1.12.15
• plugins: os-tinc fixes evaluation of hosts enabled flag (contributed by Konstantinos Spartalis)
• plugins: os-turnserver 1.3
• plugins: os-zabbix-agent 1.9
• plugins: os-zabbix-proxy 1.7
• plugins: use safe config iteration in interface registration code
• src: missing permission check in thr_kill2
• src: arbitrary file overwrite via the KTLS receive path
• src: multiple vulnerabilities in the sound mmap path
• src: sigqueue missing capability mode restriction
• src: use-after-free bug in the IPV6_MSFILTER socket option handler
• src: flaw in Linuxulator execution of setugid binaries
• src: ASLR bypass for setuid executables via procctl
• src: integer overflow in vt CONS_HISTORY ioctl
• src: openssl: fix multiple vulnerabilities
• src: ldns: fix query response validation
• src: netlink: fix lock leak in nl_find_nhop
• src: pf: avoid taking the pf rules write lock in a couple of ioctls
• src: ipfw: add ability to run ipfw binary with 15.0+ kernel module
• src: ipfw: treat ipv6 address with zero mask as “any”
• ports: curl 8.20.0
• ports: dnsmasq 2.93
• ports: filterlog 0.8 changes rule label fetch to libpfctl
• ports: kea 3.0.3
• ports: krb5 1.22.2
• ports: libxml 2.15.3
• ports: nss 3.124
• ports: openssh 10.3p1
• ports: openssl 3.0.21
• ports: openvpn 2.7.4
• ports: phalcon 5.14.2
• ports: php 8.3.31
• ports: phpseclib 3.0.55
• ports: py-duckdb 1.5.3
• ports: py-numpy 2.4.6
• ports: py-requests 2.33.1
• ports: python 3.13.14
• ports: sqlite3 3.53.1
• ports: strongswan 6.0.7

Here are the full patch notes for patch release 1:

• system: configuration line injection via multiple GUI text fields (reported by lujiefsi)
• system: add missing legacy_html_escape_form_data() for $a_cert on administration settings (reported by Jonas Ampferl of Hacking Cult)
• system: lockout: address newline injection and correct IP parsing (reported by lujiefsi)
• system: hasPrivilege() not merging user privs correctly (reported by iys8)
• system: fix ACL pattern for carp_status action (contributed by Etienne Girault)
• interfaces: prohibit the use of advanced DHCP option settings by non-administrators
• firewall: safeguard ISO country codes in alias download (reported by Jonas Ampferl of Hacking Cult)
• firewall: escape user-controlled values in tooltip attributes (reported by Jonas Ampferl of Hacking Cult)
• firewall: unify group names of OpenVPN, WireGuard and IPsec encapsulation
• firewall: skip alias on new rules GUI apply
• captive portal: pass in ip_address as a set for accounting
• firmware: fix small glitch that re-prompts for showing community plugins
• network time: fix stored XSS in GPS init string display (reported by Jonas Ampferl of Hacking Cult)
• openvpn: prevent path traversal in “common_name” attribute (reported by lujiefsi)
• openvpn: escape client common_name in connection-status views (reported by Jan Kahmen of turningpoint and lujiefsi)
• mvc: checkAndThrowValueInUse validate input token which may only contain alphanum and dashes (reported by Jonas Ampferl of Hacking Cult)
• mvc: also do not translate empty labels in grids
• ui: add generic escaping function htmlSafe() for JavaScript
• src: vm: use-after-free in device pager page list
• src: execve: local privilege escalation via execve(2) TOCTOU race
• src: openzfs: multiple vulnerabilities in OpenZFS
• src: libalias: bffer overflow in libalias RTSP handler
• src: unlinkat: unlinkat(2) ignores AT_RESOLVE_BENEATH flag
• src: tcp: use-after-free in TCP RACK stack option handler
• src: posixshm: multiple vulnerabilities in POSIX largepage objects
• src: audit: incorrect audit records for ptrace(2) syscall requests
• src: ktls: remote DOS via uninitialized memory access in KTLS receive
• src: linux: kernel stack disclosure in Linux compatibility layer
• src: iconv: multiple vulnerabilities in iconv(3)
• ports: expat 2.8.2
• ports: ldns 1.9.2

A hotfix release issued as 26.4.1p1_2:

• firmware: support for patch release matching
• openvpn: add a specific regex constraint for static keys to fix previous safeguarding

A hotfix release issued as 26.4.1p1_3:

• openvpn: further fix validation for auth token secret and static key

Here are the full patch notes for patch release 2:

• system: DTLSv1.1 is forcefully rejected by OpenSSL 3.5, migrate to DTLSv1.2
• system: use serialNumberHex for CRL so high-bit serials are not dropped (contributed by chrstnth)
• system: lower max-request-size to roughly max post size in lighttpd configs (reported by lujiefsi)
• system: do not let the components selectpicker grow indefinitely in defaults page
• system: dashboard widget does not know about patch release syntax
• system: make LDAP auth adhere to bad login penalty as well (contributed by Matt Andreko)
• reporting: do not show disabled interfaces in traffic graphs (contributed by Konstantinos Spartalis)
• firewall: use “urgent” as empty default for firewall debug messages
• firewall: invalidate rule stats cache for firewall utilities API endpoint
• captive portal: automatic block rule should be evaluated after the anti-lockout rule
• firmware: remove overzealous cleansing in output_cmd to unhide individual character progress
• monit: use throwNotFullAdmin() to restrict monit GUI write access to full admins due to intended system wide execution rights
• monit: fix mail-format and poll-time validation
• openvpn: client export can export private keys for unlisted certificate references (reported by iys8 and lujiefsi)
• unbound: missing NetMaskAllowed=N on override address
• backend: remove cache file on execution error in script_output
• mvc: safeguard some write operations with missing throwReadOnly() actions for custom action (reported by lujiefsi)
• mvc: form labels can be empty so make sure to add them to avoid warnings in forms
• ui: fix multiple stored XSS (reported by lujiefsi)
• ports: openvpn 2.7.5
• ports: suricata 8.0.6

Original source

The OPNsense business edition transitions to this 26.4 release including full MVC/API experience as automation rules have been promoted to the new rules GUI, Suricata with a new inline inspection mode using “divert”, assorted IPv6 reliability and feature improvements, router advertisements MVC/API, full code shell command escaping revamp, default IPv6 mode now using Dnsmsaq for client connectivity, Unbound blocklist source selection, an automatic host discovery service, captive portal IPv6 support plus much more.

Please make sure to read the migration notes before upgrading.

Download link is as follows. An installation guide and the checksums for the images can be found below as well.

https://downloads.opnsense.com/

This business release is based on the OPNsense 26.1.6 community version with additional reliability improvements.

Here are the full patch notes:

• system: factory reset and console tools now default to using Dnsmasq for DHCP
• system: wizard now offers an abort button and deployment type selections
• system: wizard can disable WAN or LAN interface now
• system: provide resolv.conf overrides via /etc/resolv.conf.local
• system: add XMLRPC option for hostwatch
• system: remove “upstream” from gateway grid as priority already reflects the proper data
• system: adjust gateway group priority (tier) wording
• system: add note field to store comments for each snapshot
• system: add configurable “memberOf” attribute to LDAP connector
• system: do not scrub unrelated IPv6 DHCP ranges from Dnsmasq LAN config during wizard
• system: adapt DHCP address shell setup for new config access functions
• system: adapt web GUI certificate renew for new config access function
• system: adapt initial port configuration DHCP setting for new config access functions
• system: avoid using “(system)” user revision annotation to match legacy and MVC code
• system: fix log files ‘go to page’ edge case and row count persistence/max
• system: ignore future backups when they exist to ensure new backups are saved
• system: ensure proper types are emitted in searchGatewayAction() when configd action fails
• system: use safe iteration for cert/ca in system_trust_configure()
• system: fixed broken link in modal header when using HA and saving administration settings
• system: create a backup on factory reset
• system: unify pwd_changed_at usage
• system: store dashboard layout types based on column breakpoints
• system: do not show snapshot notes in the grid
• system: use safe config iteration in admin settings page
• system: cleanup and simplify certificate deployment and remove legacy config import
• system: validate monitor uniqueness based on the host route presence
• system: simplify user/group sync scripts using config_read_array()
• system: dashboard gauge improvements (contributed by Konstantinos Spartalis)
• system: compress height of the log viewer grid
• reporting: restore canvas state in health graph to fix Firefox display bug
• reporting: use safe config iteration in RRD code
• interfaces: a new IPv6 mode called “Identity association” was added
• interfaces: add and enable new host discovery feature for neighbours via hostwatch
• interfaces: settings page was migrated to MVC/API
• interfaces: handle hostwatch user/group via package
• interfaces: force-reload IPv6 connectivity when PDINFO changes during renew
• interfaces: dhcp6c rapid-commit, request-dns and config write refactoring
• interfaces: generalise the rtsold_script code
• interfaces: use descriptive interface names in automatic discovery table
• interfaces: harden settings page with file_safe() and allowed_classes=false
• interfaces: host discovery: make sure the full dump includes NDP output on fallback
• interfaces: fix migration for IPv6 no-release option
• interfaces: fix wlanmode argument usage
• interfaces: generalise the dhcp6c_script using the new IFNAME variable
• interfaces: fix enter key in assignment description and general cleanup
• interfaces: protect device reads against forcing empty arrays into $config
• interfaces: remove unused ip_in_interface_alias_subnet()
• interfaces: use safe config iteration in PPP edit page
• interfaces: clean up overview UI code and fix CARP badge alignment
• interfaces: simplify CARP scripts using config_read_array()
• interfaces: automatic dhclient recovery
• interfaces: settings page use cases for config_read_array()
• interfaces: configurable cleanups for automatic neighbor discovery via hostwatch
• interfaces: refactor PPP CARP hook
• firewall: escape selector in rule_protocol
• firewall: “Port forward” was migrated to “Destination NAT” MVC/API
• firewall: unified look and feel of MVC/API pages formerly known as “automation”
• firewall: improved support of gateway groups in policy-based routing
• firewall: plugin support for “ether” rules has been removed
• firewall: add import/export to shaper queues and pipes
• firewall: “divert-to” support in new rules GUI
• firewall: added a rule migration page (use with care)
• firewall: make previously associated DNAT rules editable
• firewall: FilterBaseController requires BaseUserException
• firewall: fix typo with sprintf() with DNAT rule
• firewall: fix target mapping inconsistency leading to references not being processed in destination NAT
• firewall: use local-port as target when specified in destination NAT
• firewall: fix missing reply-to when not specifically set in new rules
• firewall: live view: fix parsing of combined filters stored as converted strings
• firewall: fix group rename in source_net, destination_net and SNAT/DNAT target fields
• firewall: add tcpflags_any in new rules GUI for parity with legacy rules
• firewall: exclude loopback from interface selectpicker in new rules GUI
• firewall: well known ports added to filter rule selection
• firewall: undefined is also “*” in new rules grid
• firewall: add download button for validation errors in rule import
• firewall: allow TTL usage on host entries
• firewall: add missing implementation for “disablereplyto” in new rules
• firewall: fix encoding issue in dashboard widget
• firewall: check for schedules in use in new rules
• firewall: add import/export function and missing lock on set action
• firewall: better focus selected alias updates to in crease performance when either –aliases or –types is used
• firewall: implement missing ICMP types in new rules GUI (contributed by Bjoern Jakobsen)
• firewall: adjust for parseReplace() for icmp-type “skip”
• firewall: fix NAT rule enabled checks display (contributed by Aaron Rogers)
• firewall: prevent separator char from being used in category names
• firewall: fix running into error using well known protocols with “-” in them
• firewall: add validation to prevent using both gateway and reply-to in the same rule in new GUI
• firewall: add a command button to open the live log with pre-filled rule ID in new GUI
• firewall: move download and upload commands out of partial into global commands in new GUI
• firewall: reduce complexity in URL hash handling and when using firewall_rule_lookup.php in new GUI
• firewall: fix default ipprotocol mismatch so that when not specified both are indicated
• firewall: update destination NAT ACL to match our menu entry
• firewall: fix issues with searching in the states page
• firewall: allow well known ports in local-port destination NAT
• firewall: adjust row selection behaviour for internal rules in MVC pages
• firewall: offer aliases the same was as the field type expects them
• firewall: fix access to deleted filter node in advanced settings
• firewall: merge MVC NAT page templates into a single one
• firewall: when repopulating the interface selectpicker, always restore current selection in new rules GUI
• firewall: remove hardcoded colors where possible in new rules GUI
• firewall: fix category colors in new rules GUI
• firewall: merge read of groups and interfaces in new rules GUI
• firewall: make MVC protocol selection match the old rules pages
• firewall: add model validations for common errors in destination NAT
• firewall: live view: allow regex use in “contains” cases
• firewall: live view: fix SyntaxWarning in log reader backend
• firewall: use safe iteration in old rule page for schedule lookup
• firewall: use safe config iteration in outbound NAT page
• firewall: fix regression in alias summary not shown in new rules GUI
• firewall: invalidate database when last updated time is in the future
• firewall: add missing “static port” option in source NAT
• firewall: add semantic groups coloring option in dashboard widget (contributed by Gunnar Lieb)
• firewall: add missing alias rename rule targets
• firewall: add alias GeoIP database update button and move bogons one to the same tab
• firewall: fix port handling in registered NAT rule
• firewall: fix MVC code vs. legacy rules display issues
• firewall: outbound NAT page use case for config_read_array()
• firewall: fix wrong “pass” on DNAT rule when using register rule
• firewall: adjust sort order in networks and aliases in new rules GUI
• firewall: change sorting to interface/group name and stop caring about counted rules in new rules GUI
• firewall: change category sorting using names instead of counted rules in new rules GUI
• firewall: remove tokenizer from categories and use selectpicker instead in new rules GUI
• captive portal: cleanup and simplify certificate deployment and remove legacy config import
• captive portal: enforce POST-only on logoffAction() (contributed by Oliver Jueguen)
• captive portal: add IPv6 support (partially contributed by Alex Goodkind)
• captive portal: fix allowed addresses missing from session IPs in roaming case
• dhcrelay: relax the check for present addresses and CARP-related cleanups
• dnsmasq: add automatic RDNSS option when none is configured
• dnsmasq: fix log conditions
• dnsmasq: add IP address validations for some of the DHCPv4 and DHCPv6 options (contributed by Greelan)
• dnsmasq: add “no-ping” option (contributed by Konstantinos Spartalis)
• dnsmasq: remove a too-strict validation for suffix IPv6 addresses without constructor use
• dnsmasq: ensure the lease view handles client-id correctly
• dnsmasq: prevent “*” from being collected as “client_id”
• firmware: opnsense-code: run configure script on upgrade if needed
• firmware: revoke 25.7 fingerprint
• firmware: fix automatic advanced toggle in settings
• firmware: shorten the reboot message to fit the spinner on the same line
• firmware: tweaks for update/upgrade cleanup behaviours between core and opnsense-update
• firmware: add support for aux repository handling in opnsense-update
• firmware: add aux repository support
• firmware: repeat the update after pkg reinstall
• installer: ufs: ignore errors when flushing the full disk
• intrusion detection: add a “divert” intrusion prevention mode
• intrusion detection: upgrade ET Open ruleset to version 8.0 (contributed by 0nnyx)
• ipsec: expose ChaCha20-Poly1305 AEAD proposals in IKEv2 (contributed by Kota Shiratsuka)
• ipsec: use safe config iteration for VIP lookup
• ipsec: add 4 insecure proposals for compatibility (contributed by Bjoern Jakobsen)
• kea: add libdhcp_host_cmds.so to expose internal API commands for reservations
• kea: exit prefix watcher script if no lease file exists
• kea: allow “hw-address” for reservations
• kea: add pool in subnet validation
• kea: minor code cleanups in model code
• kea: fix subnets GUI missing root node
• kea: add required scope to prefix watcher link local address route
• kea: guard prefix watcher when no link-local address exists for a route that should be installed
• kea: add DDNS and DHCP option support
• kea: add DDNS subnet-specific qualifying suffix and prevent updates if no server is set
• kea: add sockets max-retries and retry-wait-time options
• kea: add delete lease command and use socket for up-to-date lease collection
• kea: move pool-in-subnet validation logic mostly to KeaPoolsField
• kea: remove KeaCtrlAgent dependency on HA configuration
• kea: use SetConstraint for match_data to allow 0 as valid value
• monit: use safe config iteration in gateway alert script
• network time: add pool property for time servers (contributed by Konstantinos Spartalis)
• network time: remove stale symlink when PPS is disabled
• openvpn: removed the stale TheGreenBow client export
• openvpn: add options for legacy ciphers (contributed by Bjoern Jakobsen)
• openvpn: debounce learn-address calls to limit the number of alias updates to a minimum
• openvpn: add validation for selecting username as CN without setting any authentication
• radvd: migrated to MVC/API
• radvd: remove faulty empty address exception
• radvd: remove configuration file if disabled
• radvd: implement RemoveAdvOnExit override
• radvd: add Base6Interface constructor
• radvd: support nat64prefix
• radvd: change tabs to spaces in radvd.conf for better maintenance
• radvd: use safe config array iteration over virtual IPs
• radvd: when adding a manual instance for an automatic “track6” interface do not ignore its settings
• unbound: safeguard the blocklist tester against empty configuration testing
• unbound: persist overrides PTR configuration and allow the user to deselect it
• unbound: split logic in update_blocklist() and simplify getPoliciesAction()
• unbound: move policy fetch to the controller and clean up accordingly
• unbound: only emit warning when “addptr” was requested
• unbound: use expand formatter for blocklist URLs and DNSBL types
• unbound: include blocklist length in state change logic
• unbound: add harden below NXDOMAIN option (contributed by Konstantinos Spartalis)
• unbound: consolidate override aliases into tree view
• unbound: deprecate Blocklist.site blocklists (contributed by Drumba08)
• unbound: clean up blocklists update marker and size file handling
• unbound: add per-policy quick actions in reporting overview
• unbound: improve CNAME handling of whitelisted domains
• unbound: safe command execution changes
• unbound: merge extended blocklists into community version
• unbound: prevent caching of blocklist entries on overlapping subnet policies
• unbound: notify user if a blocklist reset is required
• unbound: reconfigure if marker file present
• backend: safe execution changes in the whole code base
• backend: removed short-lived mwexecf_bg() function
• backend: allow non-intrusive config_read_array() and fix a gateway group delete issue with it
• backend: removed mwexec() and mwexec_bg() functions following their deprecation
• backend: add config_push_array() and config_merge_array() helpers
• backend: remove constant configd cleanups as they may influence requests from other threads executing different commands
• backend: remove unused examples throwing errors now
• backend: fix configd using a new temporary file for cached items
• backend: more fixes for re-bound SyntaxWarning throws in Python 3.13
• backend: use config_read_array() non-insert mode mode iteration of virtual IPs
• lang: various translation updates
• lang: various language updates
• mvc: add ChangeCase support to ProtocolField for DNAT special case
• mvc: improve importCsv() to support either comma or semicolon
• mvc: removed long obsolete sessionClose() from ControllerRoot
• mvc: BaseModel: isEmptyAndRequired() has been removed
• mvc: removed unusued RegexField
• mvc: add $separator as parameter for CSV export and switch the default to a semicolon
• mvc: InterfaceField: minor adjustments and add resetStaticOptionList()
• mvc: catch empty data in CSV import
• mvc: restructure menu items and system using findNodeByPath()/getItem() additions
• mvc: BaseListField: generic implementation of static options
• mvc: PortField: make “well-known” port numbers known by allowing them to be mapped to their respective numbers
• mvc: collect UUID field so it can be searched, but only if the searchPhrase contains a valid UUID
• mvc: move CertificateField, InterfaceField and ProtocolField to newer static option API
• mvc: BaseListField: merge remaining use of shared implementation of static options
• mvc: File: add file_update_contents() helper
• mvc: Shell: rewrite exec_safe() to avoid vsprintf() complications
• mvc: BaseListField: replace empty() check with isSet() for proper selection of value “0”
• mvc: HostnameField: show string that failed validation by default
• mvc: BaseField: add setValues() for generic use
• mvc: add SetConstraint for problematic “0” value constraining
• mvc: ApiMutableModelControllerBase: remove unused error returning in setActionHook()
• rc: replace camcontrol with diskinfo for TRIM check (contributed by Maurice Walker)
• rc: speed up maintenance file deletes
• shell: opnsense-log now supports “backend” and “php” aliases
• shell: improve config restore UX using diff and additional meta data display
• tests: Shell: add testing framework
• tests: merge stable filter tests to double check upcoming changes
• ui: allow HTML tags in menu items and title
• ui: improve user readability in SimpleFileUploadDlg()
• ui: batch bootgrid enable/disable-selected toggle by default
• ui: swap order of custom bootgrid commands placement making sure they participate in command binding
• ui: remove two unused static PHP array definitions
• ui: Bootgrid: split row selection behavior into rowSelection boolean
• ui: Bootgrid: force a lightweight redraw when columns are programmatically changed
• ui: Bootgrid: fix curRowCount type conversion issue when stored in localStorage
• ui: bootgrid: require selection to be enabled for delete-selected
• ui: bootgrid: introduce ‘expand’ formatter to cap lists of data
• ui: set visibility hidden for base_bootgrid_table
• ui: upgrade Tabulator to version 6.4.0
• ui: automatic grid height calculation
• ui: bootgrid: maintain scrolling position for both datatree and command actions
• plugins: os-acme-client 4.15
• plugins: os-caddy 2.1.0
• plugins: os-ddclient 1.29
• plugins: os-freeradius 1.10
• plugins: os-frr 1.51
• plugins: os-haproxy 5.1
• plugins: os-isc-dhcp 1.0
• plugins: os-netbird 1.2
• plugins: os-nextcloud-backup 1.2
• plugins: os-nginx 1.36
• plugins: os-postfix 1.24.1
• plugins: os-q-feeds-connector 1.5
• plugins: os-tailscale 1.4
• plugins: os-tayga 1.5
• plugins: os-theme-cicada 1.41 (contributed by Team Rebellion)
• plugins: os-theme-flexcolor 1.1 (contributed by Schnuffel2008)
• plugins: os-theme-tukan 1.31 (contributed by Team Rebellion)
• plugins: os-theme-vicuna 1.51 (contributed by Team Rebellion)
• plugins: os-turnserver 1.2
• plugins: os-upnp 1.9
• plugins: os-wazuh-agent 1.3
• src: assorted patches from stable/14 for LinuxKPI, QAT, and network stack
• src: if_ovpn: use epoch to free peers
• src: carp6: revise the generation of ND6 NA
• src: igmp: do not upgrade IGMP version beyond net.inet.igmp.default_version
• src: igmp: apply net.inet.igmp.default_version to existing interfaces
• src: ice: handle allmulti flag in ice_if_promisc_set function
• src: icmp6: clear csum_flags on mbuf reuse
• src: divert: Use a better source identifier for netisr_queue_src() calls
• src: if_ovpn: add interface counters
• src: e1000: fix setting the promiscuous mode
• src: pfctl: allow new page character (^L) in pf.conf
• src: sctp: support bridge interfaces
• src: ifconfig: assorted stable fixes
• src: ip_mroute: assorted stable fixes
• src: vtnet: assorted stable fixes
• src: pf: silently ignores certain rules
• src: vnet: ensure the space allocated by vnet_data_alloc() is sufficent aligned
• src: ifnet: Fix decreasing the vnet interface count
• src: e1000: Increase FC pause/refresh time on PCH2 and newer
• src: net80211: fix VHT160/80P80/80 chanwidth selection in the “40-” case
• ports: curl 8.19.0
• ports: dhcp6c v20260122
• ports: expat 2.7.4
• ports: hostwatch 1.0.13
• ports: ldns 1.9.0
• ports: libucl 0.9.4
• ports: libxml 2.15.2
• ports: nss 3.121
• ports: openldap 2.6.13
• ports: openssl 3.0.20
• ports: openvpn 2.6.19
• ports: perl 5.42.2
• ports: phpseclib 3.0.50
• ports: py-duckdb 1.5.0
• ports: python 3.13.13
• ports: strongswan 6.0.4
• ports: suricata 8.0.4
• ports: syslog-ng 4.11.0

Hotfix release 26.4_6

A hotfix release was issued as 26.4_6:

• system: protect popen() with exec_safe()
• system: lockout bypass fix (contributed by Konstantinos Spartalis)
• system: allow gateway load balance weights from 1 to 10 for more flexibility (contributed by Matthew Hall)
• system: add “nosync” option to gateway configuration
• firewall: fix typo in alias update error log and make parser a bit more resilient
• firmware: opnsense-update: handle FreeBSD.conf disable internally
• plugins: os-acme-client 4.16
• src: vm_fault: reset m_needs_zeroing properly
• src: timerfd: Fix interval callout scheduling
• src: tty: avoid leaving dangling pointers in tty_drop_ctty()
• src: pkru: fix handling of 1GB largepage mappings
• src: contrib/tzdata: import tzdata 2025c, 2026a and 2026b
• src: amd64: fix INVLPGB range invalidation
• src: pf: improve SCTP validation
• src: execve: fix an operator precedence bug
• src: dhclient: check for unexpected characters in some DHCP server options
• src: dhclient: fix reallocation of dhclient script environments
• src: libnv: switch fd_wait() from select(2) to poll(2)
• src: libnv: fix heap overflow in nvlist_recv()
• src: libpcap: update to 1.10.6
• src: ipfw_nptv6: fix handling the ifaddr removal event
• src: if_tuntap: make SIOCIFDESTROY interruptible
• src: pfctl: parser must not ignore error from pfctl_optimize_ruleset()
• src: pf: fix duplicate rule detection for automatic tables
• src: openssl: update from 3.0.16 to 3.0.20
• src: routing: fix use-after-free in finalize_nhop
• src: ixgbe: fix MRQC register value
• src: in_mcast: Fix a lock leak in inp_set_source_filters()
• src: linuxkpi: fix an off-by-one error in the kfifo implementation
• src: sctp: fix so_proto when peeling off a socket
• ports: expat 2.8.0
• ports: openvpn 2.6.20
• ports: strongswan 6.0.6

Hotfix release 26.4_14

A hotfix release was issued as 26.4_14:

• system: properly escape username in sync_user.php command invoke (contributed by Konstantinos Spartalis)
• system: fix XMLRPC sync with VIP and “nosync” option
• interfaces: safeguard DHCPv4 settings against arbitrary command injection (reported by Kchigo)
• captive portal: re-introduce hash lookup for accounting purposes
• captive portal: reload IPFW on captive portal reconfigure too
• dnsmasq: ignore DHCP names for “wpad” to fix CERT Vulnerability VU#598349
• network time: fix ACL definitions (contributed by Konstantinos Spartalis)
• openvpn: reload configuration for group sync after successful authentication
• ports: dnsmasq 2.92rel2
• ports: expat 2.8.1

Hotfix release 26.4_20

A hotfix release was issued as 26.4_20:

• system remove unused data-tooltip that is not properly escaped from certificates widget
• interfaces: dhclient.conf does not cope with multi-line request/require
• firewall: fix for missing HTML escape in description render in legacy rules GUI
• monit: sanitize monit output before offering it
• network time: cleanse port option before use (reported by Konstantinos Spartalis)
• mvc: do not translate empty strings
• src: dhclient: improve server and filename validation
• src: setcred: fix buffer overflow
• src: kern: make sure to drain selinfo sleepers
• src: fusefs: handle buggy server LISTXATTR response
• src: ptrace: fix validation of PT_SC_REMOTE arguments
• src: libcasper: switch from select(2) to poll(2)
• src: cap_net: do not allow new limits to drop keys from the old ones
• src: ipfw: fix parsing error in nat config port_range
• src: ipfw: fix checksum after NAT
• src: igmp: Avoid leaving dangling pointers in the state-change queue
• src: vxlan: Update *m0 after a pullup
• src: routing: use a better error number in sysctl_fibs()
• src: routing: initialize V_rt_numfibs earlier during boot
• src: pfsync: reject invalid SCTP states
• src: pf: do not reject rules with colliding hashes
• src: rtnetlink: check for allocation failure in nlattr_get_multipath()
• src: rtnetlink: align RTA_MULTIPATH length validation in nlattr_get
• ports: suricata 8.0.5
• ports: unbound 1.25.1

Migration notes, known issues and limitations

• ISC-DHCP moves to a plugin. It will be automatically installed during upgrades. It is not installed on new installations because it is not being used, but you can still install and keep using it.
• To accommodate the change away from ISC-DCHP defaults the “Track interface” IPv6 mode now has a sibling called “Identity Association” which does the same except it is not automatically starting ISC-DHCPv6 and Radvd router advertisements to allow better interoperability with Kea and Dnsmasq setups.
• Dnsmasq is now the default for DHCPv4 and DHCPv6 as well as RA out of the box. One thing that the upstream software cannot cover is prefix delegation so that is no longer offered by default. Use another DHCPv6 server in this case.
• Due to command line execution safety concerns the historic functions mwexec_bg() and mwexec() were removed. Make sure your custom code is not using them and use mwexecf(), mwexecfb() and mwexecfm() instead.
• The function sessionClose() has also been removed from the MVC code and is no longer needed. Make sure to remove it from your custom code.
• The custom.yaml support has been removed from intrusion detection. Please migrate to the newer /usr/local/etc/suricata/conf.d override directory.
• The new host discovery service “hostwatch” is enabled by default. You can always turn it off under Interfaces: Neighbors: Automatic Discovery if you so choose.
• The firewall migration page is not something you need to jump into right away. Please make yourself familiar with the new rules GUI first and check the documentation for incompatibilities. Single interface from the floating interface will not be considered “floating” in priorities.
• Firewall: NAT: Port Forwarding is now called “Destination NAT”. Firewall rule associations are no longer supported, but the old associated firewall rules remain in place with their last known configuration and can now be edited to suit future needs.
• Firewall: NAT: Source NAT is from the set of pages formerly known as automation, but Outbound NAT is still the main page for these types of rules.
• Unbound blocklists are now the same between business and community version. This requires a manual reapply of the blocklists in order to use the new shared format.

The public key for the 26.4 series is:

# -----BEGIN PUBLIC KEY-----
# MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEArTnFQp0jjj5bkLNx9G1j
# q26WmN/EtAaJUt+2MY8W8h7L3kokRMlTgEvCYJOkUjbJYbjuG0Cut3JExNYa1vdD
# 1SLIlJShyI8OsjbAS/flZdJB9c0Vxz2CwpoX9Efmp5TaB3GWqhHS0OVLx4MSI3HJ
# qP/aQLjZMuCQHX8beUQB77YWcT6sPC5UMYeNEW1uHR7Oki/TpOXWnzNStEQXRL6/
# MiuYJovedlNXeNUeebJyG0TyLJ/3uGMYhHKYK+OJkB03P3iLGGVE/WWNugsqX6bY
# tTU9PquHo5zDApndp8iG49Fs/DC0r7V1P85ETPtW2SuZQ7YeDuz3VKvuMxAqyQoC
# 1FLOsIuEfudDmRuMuTsRgB6jaGACEWUTuRyiFG4+kVDi1/qOWpYatP8C8B7Lx9UU
# CTZhCl+Se4woWGtp5KOtYe+pvJ4oz40SL4drUQFEP3ZOsK/HzyLjPFRgxfANNUPG
# ONayKHJXVVFPg2ATk9jeNPsLmXlcDmi/rihyN4RM2w0/bi8BWSc+dMGZ5ZhNJdsF
# wHBIscgpiAhs+HS8Usxy3idv/JkY0h9tZ2QnljhUUwhYV+DT9yZf5ABU0B68VjJ4
# /GloUc3bS7HBeSTAauYMOQvgkY1vcySGWTXvsGOw/Crpk4DYx5KpGNYHmENRey2c
# AQdi+Fvi3fFkV1BoxGo78NcCAwEAAQ==
# -----END PUBLIC KEY-----
# SHA256 (OPNsense-business-26.4-dvd-amd64.iso.bz2) = 201fa8fb384fda534853f2a0fbc82aecbb8753e37a77426f55a1478029b02a2e
# SHA256 (OPNsense-business-26.4-nano-amd64.img.bz2) = e133243e85aa630d00d29ea78b8f6fe3b87de06bd7e62f88c3c8fed1b51edb9e
# SHA256 (OPNsense-business-26.4-serial-amd64.img.bz2) = 44dfd3a696bd04961145e40478128b75d911f0e8d6a9ea2a6d20a3b6205c7bc5
# SHA256 (OPNsense-business-26.4-vga-amd64.img.bz2) = 52c4d12b87c5464f9bfff9124a6c3a1c1dd52bb9a6a16d8e5b5cdeee4f108c78

Original source

This business release is based on the OPNsense 25.7.10 community version with additional reliability improvements, but without revamped Unbound blocklists for the time being.

Here are the full patch notes:

system

• gateway monitor Shell class use et al
• no longer back up DUID but add compatibility glue to opnsense-importer
• replace exec() in config encrypt/decrypt
• replace history diff exec() with shell_safe()
• safe execution tweaks in rc.routing_configure
• fix log keyword search regression introduced in 25.7.7
• clean up and normalise the sample config.xml
• replace “realif” variables with “device” in gateway code
• replace exec() in live banner SSH probe
• add tooltip explaining active status in snapshots
• add “lazy loading” model support on TrustCert
• properly fill DNS SAN from existing certificates (contributed by Klaas Demter)
• rename sudoers file to make it more sortable (contributed by David Jack Wange Olrik)
• numerous safe execution changes
• sort to retain order in syslog-ng source definitions
• fix edge case in tunable reset with one single tunable in the default config

reporting

health

• add CPU temperature y-axis label (contributed by NOYB)

interfaces

• scan pltime/vltime in “ifconfig -L” mode
• fix comparison in PPP check code during assignment
• prefer longer lifetimes if multiple exist
• defer manual rtsold script execution
• use mwexecfb() in two instances
• move configure_interface_hardware() to main file
• migrate “sharednet” setting to its respective sysctls

firewall

• run filterlog directly after rules apply and remove promiscuous mode
• allow setting a custom authentication HTTP header for alias URL fetch (contributed by nox-404)
• for better IPv6 PMTU let “timex” and “paramprob” ICMP types through
• safe execution changes in rules reloading code
• safe execution changes in rc.filter_synchronize
• aliases: add has_parser() to check if an alias has a valid parser available
• live log: allow column modifications and combine hostname columns
• live log: add bigger table size options and simplify table update
• minor simplification in filter sync script
• automation: only show ICMP type when protocol is ICMP
• automation: add multi-select ICMP6 options
• simplify port alias check
• improve GeoIP alias expiry condition
• prevent autocomplete in alias auth password

captive portal

• re-introduce ipfw for accounting purposes only
• assign empty array when “interface list arp json” returns invalid JSON

dhcrelay

• add CARP VHID tracking option to relays
• use the new mwexecf() $format support
• reload table to update relay status

dnsmasq

• minor tweaks in lease commands
• add DHCP logging flags to influence log verbosity

firmware

• Shell class replacements in scripting

intrusion detection

• refactor query scripts and deprecate params.py
• increase maintainability of suricata.yaml file
• add support for /usr/local/etc/suricata/conf.d directory
• clean up views and controllers
• datakey hint was missing for rules edit
• replace “all” alert selection with explicit maximum choices

ipsec

• most safe execution transformations done

isc-dhcp

• move syslog definitions to plugin file
• interalize interfaces_staticarp_configure()
• safeguard access to DHCPv6 “enable” property
• check if device we try to configure exists in the system

kea-dhcp

• add lease commands, tabulator GroupBy, URL hashes
• add DNR option (contributed by schreibubi)
• refactor daemon(8) call to mwexecfb()

network time

status

• refactor to MVC/API
• fix GPS coordinate display in status page (contributed by brotherla)

openvpn

• openvpn: add AES-256-CBC cipher for legacy compat (contributed by Fabian Franz)
• add support for verify-x509-name option (contributed by laozhoubuluo)
• replace exec() in MVC code
• add simple search functionality for accounts table in client export
• skip dynamic content when loading the model in client export
• convert two more exec() calls
• account for CARP status in start and restart cases as well

unbound

• remove delete selected button for single select overrides grid
• add overrides reference counter for aliases
• info section was larger than table width

backend

• minor shell execution changes and readability
• use mwexecf(m) where possible
• extend mwexecfb() with PID and log file support
• exec() removal in get_sysctl()/set_sysctl()
• exec() removal in auth scripts

mvc

• ApiMutableModelControllerBase: add invalidateModel() method
• Config: use is_int()/array_key_first() in toArray() and fromArray()
• Config: mvc: use LIBXML_NOBLANKS when loading config files
• get translated services description from API (contributed by Tobias Degen)
• BaseField: provide asInt() method
• reduce some call overhead in BaseField/IntegerField
• introduce defaultConfig property for AppConfig
• uppercase all form labels
• use asInt() in GidField and UidField
• BaseField: add isSet()
• shield exec_safe() against fatal type errors

rc

• bootstrap /var/lib/php/tests for upcoming test case use

shell

• rewrite timeout() using safe execution functions

tests

• revamped config and base model tests

ui

• refresh notification status after default apply button is done
• remove obsolete jQuery bootgrid files
• bootgrid: allow conditional command rendering through a filter function

plugins

• os-acme-client 4.11
• os-frr 1.50
• os-ndp-proxy-go 1.3
• os-telegraf 1.12.14
• os-theme-rebellion 1.9.4 (contributed by Team Rebellion)
• os-turnserver 1.1
• os-upnp 1.8 features assorted improvements to plugin and daemon (contributed by Self-Hosting-Group)
• os-zabbix-agent 1.18
• os-zabbix-proxy 1.16

src

• divert: define semantics for SO_REUSEPORT_LB on divert sockets
• divert: fix removal of divert sockets from a group
• divert: use a jenkins hash to select the target socket
• divert: use CK_SLISTs for the divcb hash table
• e1000: revert “try auto-negotiation for fixed 100 or 10 configuration”
• in6: modify address prefix lifetimes when updating address lifetimes
• ipv6: do not complain when deleting an address with prefix length of 128
• netlink: do not directly access ifnet members
• netlink: do not overwrite existing data in a linear buffer in snl_writer
• netmap: let memory allocator parameters be settable via loader.conf
• pf: fix handling of IPv6 divert packets
• pf: rationalize the ip_divert_ptr test
• pfsync: avoid zeroing the state export union
• rtsold: check RA lifetime before triggering the one-shot always script
• fix multiple vulnerabilities in OpenSSL
• jail escape by a privileged user via nullfs
• arm64 SVE signal context misalignment
• page fault handler fails to zero memory

ports

• dpinger 3.4
• filterlog no longer uses unneeded promiscuous mode
• libucl 0.9.3
• libxml 2.15.1
• nss 3.119.1
• openssl 3.0.19
• phpseclib 3.0.48
• python security fixes
• suricata 8.0.3

A hotfix release was issued as 25.10.2_3:

captive portal

• fix hard-timeout calculation

firmware

• avoid update-hook background cleanups

mvc

• fix CSRF vulnerability in multiple API endpoints by enforcing POST-only requests (contributed by Oliver Jueguen)

src

• file: qualify pointers to capsicum rights as const
• file: add a fd flag with O_RESOLVE_BENEATH semantics
• file: Fix the !CAPABILITIES build
• unix: Set O_RESOLVE_BENEATH on fds transferred between jails
• rtsock: Fix stack overflow

A hotfix release was issued as 25.10.2_4:

unbound

• fix blocklist add in reporting page following POST-only fix

A hotfix release was issued as 25.10.2_8:

interfaces

• fix static neighbor apply button (contributed by Konstantinos Spartalis)

firewall

• one-to-one NAT rendered rule missed “log” statement

ipsec

• fix delete selected for SPD and SAD

mvc

• ConfigMaintenance: when constructing class names use a safer way to strip .php extension

src

• remote code execution via RPCSEC_GSS packet validation
• tcp: remotely exploitable DoS vector

A hotfix release was issued as 25.10.2_10:

system

• escape LDAP username during search (reported by Matt Andreko)

unbound

• limit duckdb to a single thread in write mode to reduce logger memory usage

A hotfix release was issued as 25.10.2_11:

system

• move ldap_escape() to caller for now to avoid side effects

A hotfix release was issued as 25.10.2_12:

firmware

• add upgrade hint and fingerprint for 26.4 plus isc-dhcp plugin migration

Original source

This business release is based on the OPNsense 25.7.8 community version with additional reliability improvements, but without revamped Unbound blocklists for the time being.

Please be aware that during the update check the new package manager will be installed, but will fail to report the update status like it always had before and so you will end up with an error that will require checking for updates again. The fix is in this update, but impossible to install without upgrading the package manager first. We hope this will only be a minor inconvenience during the process.

Also, Python has reported security issues of which a DoS in http.client could potentially affect existing installations given that an HTTP server sends a malicious response which “can consume a large amount of memory and CPU time and cause swapping”. Python has not released an update for version 3.11 at this point in time.

Here are the full patch notes:

system

• use new file_safe() in two instances
• improve the HA VIP sync code
• simplify RRD backup code and remove exec() usage (reported by Alex Williams from Pellera Technologies working with Trend Zero Day Initiative)
• move valid_from search criteria to log_matcher for faster end of search
• use file_safe() in gateway monitor watcher
• refactor factory reset page to MVC and add a reset per component operating on models
• fix a HA sync regression introduced in 25.7.6 that prevented a sync from succeeding in an edge case
• defaults: properly delete empty model containers in the configuration
• switch int/bool to string in gateway properties
• ignore TypeErrors when parsing log lines in the backend
• replace various raw exec(), system(), passthru() and shell_exec() calls with safer variants
• add host route deletion support to system_host_route()
• move the general page host route removal to system_host_route()
• add CA chain to PKCS12 export
• fix hidden syslog HA XMLRPC sync option

interfaces

• fix permission of packet capture file in strict security mode
• ifctl: always allow reads to internal state files
• fix overview details button not working
• support link-local IPv6 mode
• also stop PPPoE connections when CARP is temporarily disabled (contributed by René Mayrhofer)
• fix packet capture and ping buttons not working since 25.7.7
• limit execution of sysctl scope in PPP device edit code
• safer interfaces_pfsync_configure() handling

firewall

• refactor live log using a ring buffer
• add toggles to disable selected automatic rules
• enable “safe delete” for categories
• improved stats rendering on automation rules
• allow searching aliases in automation rules inspect mode by IP address
• automation: fix alias IP address search
• automation: allow interface parameter to contain a list of interfaces for API users
• aliases: replace invalid unicode chars (contributed by Marius Halden)
• live log: only execute redraw on visibility state transition
• live log: optimize viewbuffer rendering
• live log: prevent re-resolving in-flight requests and move host lookup to current filtered view
• live log: restructure DOM layout to reduce wasted header space
• live log: revert static property, persistence is disabled for this grid
• states: fix delete_selected firewall states (contributed by Alexander Sulfrian)
• do not allow nesting in GeoIP aliases
• automation: split search logic and normalize legacy output
• aliases: add a few GeoIP related logging messages
• mute pfctl-based table entry expire to avoid cron noise due to stderr use
• aliases: missing placeholder for username in basic auth type selection
• support “0” as valid rule ID in rule lookup redirect
• automation: add per-rule state timeouts for “udp.first”, “udp.multiple” and “udp.single”

captive portal

• fix selectpicker #voucher-groups not being re-rendered after change event
• move grid init to tab show event

dnsmasq

• strict hostname and domain validation plus improved ipset validations
• add optgroup support to DHCP option fields and expose all DHCPv4 options
• switch to file_safe() use in backend
• minor safe execution changes in backend

firmware

• package manager upgrade changes for pkg 2.x

intrusion detection

• remove obsolete “ac-bs” pattern matcher algorithm

ipsec

• sessions: add datakey property for row mapping
• status: search phase 2 triggered twice on click and cleanup tooltip event as well
• disable model caching on SPD page
• add AES256GCM16 to the child ESP proposals list
• hide phase 2 output based on phase 1 status instead of the row count for phase 2
• add “reqid_base” setting to advanced settings
• sessions: fix missing commands translation
• connections: prevent model caching when referring items within the same model

isc-dhcp

• adjust backend for safe execution

kea-dhcp

• automatic route support for PD leases
• case insensitive MAC address comparison

openssh

• minor safe execution change in backend

openvpn

• add support for pushing excluded routes via net_gateway (contributed by Patrice Damezin)
• allow multiple domains settings for client connection (contributed by Krisztian Ivancso)
• use file_safe() to write CRL files
• swap description and mode in “tls_key” and require a description for static keys
• one safe execution change
• add fast-io option (contributed by mdten)

radvd

• safe execution changes

unbound

• use file_safe() for root hint creation
• deprecate unmaintained AdAway blocklist (contributed by Maurice Walker)
• duplicate pointer records due to not casting the field types
• missing lock in del_host_override action

wireguard

• add debug option to instances
• fix wrong maximum value for “PersistentKeepalive”

backend

• add file_safe() helper for atomic file creation
• rename “realif” variables to “device” in a number of spots
• avoid the use of get_real_interface() when it does not matter and remove dead code associated with that
• exend shell_safe() to emulate exec() $output argument magic
• reimplement existing command execution functions with Shell class implementation
• replace mwexecf_bg() with mwexecfb() for clarity

mvc

• add RegexField to properly validate PCRE2 syntax
• support arrays in search clauses
• OptionField: properly translate optgroup
• JsonKeyValueStoreField: fix race condition when using SourceField in the model
• persist models description in root attribute of its respective configuration
• tweaked model definitions, especially descriptions and validation message style
• slightly adjust two getOption() calls in constraints
• BaseListField: always map values in getDescription()
• BaseListField: account for option container and passthrough value
• remove getCurrentValue() compatibility wrapper
• Backend: always return strings in configdRun() and configdpRun()
• improve replaceInputWithSelector() to support an empty placeholder
• setDefault() not fired as setValue() was set with an empty string
• allow empty responses to fix a regression due to stream output safety path addition
• remove empty string fallbacks for backend invokes that are no longer needed
• more style changes on existing core models
• disable Dnsmasq/Unbound template generation
• remove getDescription() overlay in ModelRelationField
• protect JSON response against UFT-8 encoding failures
• HTML-decode select element values

rc

• make changes to php,var,tmp bootstrap

ui

• switch from Bootgrid to Tabulator for MVC grid rendering
• numerous switches to shared base_bootgrid_table and base_apply_button use
• flatten nested containers for grid inclusion
• use snake_case for all API URLs and adjust ACLs accordingly
• move tooltip load event to single-fire mode
• add checkmark to SimpleActionButton as additional indicator
• improve menu icons/text spacing (contributed by Konstantinos Spartalis)
• bootgrid: clean up leftover compatibility bits
• bootgrid: add missing sortable option
• bootgrid: provide more styling possibilities from formatters
• fix language selection for low vertical resolution screens (contributed by Konstantinos Spartalis)
• hide header of the picture widget on the dashboard (contributed by Konstantinos Spartalis)
• bootgrid: add tabulatorOptions to translateCompatOptions()
• bootgrid: raise rowCount default to 50 and adjust selections accordingly for most pages
• bootgrid: simplify custom grid command additions
• do not add an empty option into an empty option group
• add datetime-local to field types

plugins

• replace variables in package scripts by default
• os-OPNBEcore 1.6 with OpenID Connect and scheduled jobs support
• os-OPNWAF 2.0 with OpenID Connect support, customizable error documents and updated rule set
• os-acme-client 4.10
• os-bind 1.34
• os-c-icap 1.9
• os-caddy 2.0.4
• os-clamav 1.8.1
• os-crowdsec 1.0.12
• os-dnscrypt-proxy 1.16
• os-etpro-telemetry 1.8 now shows more status responses in widget
• os-frr 1.47
• os-gdrive-backup 1.0 for Google Drive backup support
• os-grid_example 1.1 updates best practice on grid development
• os-netbird 1.0 (contributed by Gauss23 and Bethuel Mmbaga)
• os-netbird 1.1 fixes service startup and switches to syslog (contributed by Bethuel Mmbaga)
• os-nginx 1.35
• os-openvpn-legacy 1.0 for legacy OpenVPN components support
• os-puppet-agent 1.2
• os-shadowsocks 1.3
• os-smart 2.4 adds extended info option (contributed by poisonbl)
• os-squid 1.3
• os-strongswan-legacy 1.0 for legacy IPsec components support
• os-telegraf 1.12.13
• os-theme-advanced 1.1 (contributed by Jaka Prašnikar and Raushan Patel)
• os-theme-cicada 1.40 (contributed by Team Rebellion)
• os-theme-tukan 1.30 (contributed by Team Rebellion)
• os-theme-vicuna 1.50 (contributed by Team Rebellion)
• os-zabbix-agent 1.17
• os-zabbix-proxy 1.14

src

• FreeBSD 14.3-RELEASE-p4 plus assorted stable/14 networking commits
• add a new sysctl in order to differentiate UEFI architectures
• libarchive: merge version 3.8.1
• lagg: fix if_hw_tsomax_update() not being called
• wg: add support for removing allowed-ip entries and assorted cleanups
• ovpn: support multihomed server configurations and assorted cleanups
• netlink: fully clear parser state between messages
• udp: fix a inpcb refcount leak in the tunnel receive path
• p9fs: assorted fixes
• assorted network stack fixes via stable/14
• if_ovpn: support IPv6 link-local addresses
• if_ovpn: support floating clients
• if_ovpn: fill out sin_len/sin6_len
• if_ovpn: destroy cloned interfaces via a prison removal callback
• ifconfig: support VLAN ID in static/deladdr
• bnxt: fix the request length in bnxt_hwrm_func_backing_store_cfg()
• iflib: set the get counter routine prior to attaching the interface
• ifnet: defer detaching address family dependent data
• ixgbe: fix incomplete speed coverage in link status logging
• ixl: fix queue MSI and legacy IRQ rearming
• openssl: fix multiple vulnerabilities
• re: add PNP info for module
• re: make sure re_rxeof() is called in net epoch context
• vfs: fix copy_file_range() failing to set output parameters
• ports: curl 8.16.0
• ports: dnspython 2.8.0
• ports: expat 2.7.3
• ports: kea 3.0.2
• ports: libxml 2.14.6
• ports: nss 3.118.1
• ports: openssh 10.2p1
• ports: openvpn 2.6.17
• ports: pcre2 10.47
• ports: php 8.3.28
• ports: pkg 2.3.1
• ports: python 3.11.14
• ports: sqlite 3.50.4
• ports: strongswan 6.0.3
• ports: suricata 8.0.2
• ports: syslog-ng 4.10.2
• ports: unbound 1.24.2

A hotfix release was issued as 25.10.1_2:

firewall

• clean up rules edit cancel button

firmware

• opnsense-update: remove architecture pinning for -X option

mvc

• FilterBaseController: move shared automation rule logic here

src

• e1000: do not enable ASPM L1 without L0s
• e1000: bump 82574/82583 PBA to 32K
• if_ovpn: use IFT_TUNNEL
• ifconfig: bring back -L for netlink
• igb: fix VLAN support on VFs
• irdma: fix potential memory leak on qhash cqp operation
• ix: add support for debug dump for E610 adapters
• netmap: fix error handling in nm_os_extmem_create()
• pf: reading rules with a read lock on ioctl
• pf: relax sctp v_tag verification
• pf: handle divert packets
• pfsync: fix incorrect unlock during destroy
• rtsold: remote code execution via ND6 router advertisements

Original source

The OPNsense business edition transitions to this 25.10 release including revamped frontend grid UI, experimental privilege separation for the GUI, a new and improved firewall automation GUI, performance enhancements especially for numerous aliases being used at once, OpenID Connect integration, captive portal backend rewrite, Greek as a new language, FreeBSD 14.3 plus much more.

Please make sure to read the migration notes before upgrading.

Download link is as follows. An installation guide and the checksums for the images can be found below as well.

This business release is based on the OPNsense 25.7.5 community version with additional reliability improvements.

Here are the full patch notes:

• system: the setup wizard was rewritten using MVC/API
• system: change default DHCP use from ISC to Dnsmasq for factory reset and console port and address assignments
• system: numerous permission, ownership and directory alignments for web GUI privilege separation
• system: allow experimental feature to run web GUI privilege separated as “wwwonly” user
• system: add a banner when trying to revert the privilege separated GUI back to root at run time
• system: consistently use empty() checks on “blockbogons”, “blockpriv”, “dnsallowoverride” and “dnsallowoverride_exclude”
• system: change default system domain to “internal” (contributed by Self-Hosting-Group)
• system: remove the “optional” notion of tunables known to the system
• system: enable kernel timestamps by default
• system: allow CSR to be downloaded from System/Trust/Certificates (contributed by Gavin Chappell)
• system: HTML decode entities when generating new QR code for user
• system: add missing timestamp formatter in snapshots
• system: prevent misconfigurations with the automatic user creation option
• system: add pluginctl hook for cache_flush
• system: rewrite wwwonly bootstrap procedure
• system: allow authentication events from wwwonly user
• system: fix two regressions due to stream output path safety addition
• system: fix reconfigure control on HA status page for small viewports
• system: add pluginctl -m and -v options for model migrations and validations calls
• system: add “power off” backend action to GUI cron options
• system: add the pfsync “defer” option to high availability
• system: return both interfaces in a single call for get_nameservers()
• system: safeguard legacy local_sync_accounts() against malformed user entries
• system: change atrun interval to every minute
• reporting: removed the unused second argument in getSystemHealthAction()
• reporting: renamed getRRDlistAction() to getRrdListAction()
• reporting: fixed internal parameter names in insight graphs
• interfaces: fix media settings write issue since 24.7 as it would not apply when “autoselect” result already matched
• interfaces: removed defunct SLAAC tracking functionality (SLAAC on WAN still works fine)
• interfaces: no longer fix improper WLAN clone naming at run time as it should be ensured by code for a long time now
• interfaces: remove the functions get_configured_carp_interface_list() and get_configured_ip_aliases_list()
• interfaces: add VIP grid formatter to hide row field content based on the set mode
• interfaces: drop redundant updates in rtsold_resolvconf.sh (contributed by Andrew Baumann)
• interfaces: moved get_real_interface() to util.inc
• interfaces: replace MAC vendor database from py-netaddr with a simple local implementation
• interfaces: refactor getting both devices from interface in settings page
• interfaces: get both devices of interface in one call
• interfaces: fix flags display in interface overview detail
• firewall: add expire option to external aliases to automatically cleanup tables via cron
• firewall: removed the expiretable binary use in favour of the builtin pfctl
• firewall: speed up alias functionality by using the new model caching
• firewall: consolidated ipfw/dnctl scripting and fix edge case reloads
• firewall: code cleanup and performance improvements for alias diagnostics page
• firewall: assorted UI updates for automation pages
• firewall: a few minor improvements in automation GUI
• firewall: remove unused “set loginterface” clause
• firewall: additional statistics for alias grid
• firewall: fix shaper reset button
• firewall: add “quick” mode in alias update to skip table size comparison during schedules
• firewall: adjust firewall_rule_lookup to open correct interface and rule from firewall live log
• firewall: add port alias selection to source_port and destination_port
• firewall: implement alias description tooltip and other UX tweaks
• firewall: add optional Tabulator tree view to show categories as rule folders in automation
• firewall: put sequence and sort_order in advanced mode of automation rules
• firewall: front-end table rendering performance improvement for alias diagnostics
• firewall: also set groups for special IPv6 interfaces
• firewall: ignore empty lines for pf table counting
• firewall: support tags in source NAT automation rules
• firewall: allow alias nesting for URL tables
• firewall: fix interface_net aliases not being populated
• firewall: fix return value when failing to resolve host entries for aliases and no previous content is known
• firewall: treat “skip” protocol as a string to avoid syntax error
• firewall: improve alias parsing performance in diagnostics page
• firewall: support IPinfo format for GeoIP
• firewall: adapt default table size calculation
• firewall: fix flags not showing on GeoIP selection
• captive portal: migrate backend from IPFW to PF
• captive portal: fix regression when NAT reflection is enabled
• captive portal: fix command line argument parsing in backend
• captive portal: remove obsolete interfaces_inbound option that works by default now
• captive portal: missing fix for command line argument parsing in backend
• captive portal: fix display issue for pass rule when client not in zone
• captive portal: allow disabling automatic firewall rules
• captive portal: exclude portal table in destination
• captive portal: restore the logging of drop reasons
• captive portal: fix last_accessed being cached from previous entries if N/A
• captive portal: mark alias as type external for use in rules
• captive portal: align accounting session timeout with API
• captive portal: make room for additional authentication profiles
• captive portal: API dispatcher is now privilege separated via “wwwonly” user and group
• captive portal: preparations for SSO identification support
• captive portal: move backend scripts directory
• captive portal: various style cleanups
• captive portal: restyle default login template
• captive portal: case insensitive MAC parsing
• captive portal: remove stale dir-listing.activate from web server
• captive portal: support OpenID Connect authentication through custom template
• dnsmasq: add optional subnet mask to “dhcp-range” to satisfy DHCP relay requirements
• dnsmasq: sync CSV export with ISC and Kea structure
• dnsmasq: add CNAME configuration option to host overrides
• dnsmasq: add ipset support
• dnsmasq: swap hosts and domains tab for consistency reasons
• dnsmasq: allow disabling local for DHCP domains
• dnsmasq: add Tabulator “groupBy” functionality to group by interfaces
• dnsmasq: add leases widget that shows latest leases
• dnsmasq: refine the selection of automatic DHCP rules for eligible interfaces
• firmware: opnsense-version: build time package variable replacements can now be read at run time
• firmware: hide community plugins by default and add a checkbox to unhide them on the same page
• firmware: introduce a new support tier 4 for development and otherwise unknown plugins
• firmware: disable the FreeBSD-kmods repository by default
• firmware: opnsense-version: support more elaborate -R replacement
• firmware: store update and upgrade logs in edge cases
• firmware: opnsense-version: support file based -R option
• firmware: opnsense-update: support -g for update log view
• firmware: remove tier 2 workaround for Zenarmor plugins
• firmware: add date to modal header
• firmware: opnsense-patch: fix cache flush using new hook
• firmware: add vuxml.freebsd.org to CRL handling hostnames
• firmware: switch business mirror layout
• intrusion detection: add JA4 support (contributed by Maxime Thiebaut)
• intrusion detection: fix interface name conversion
• intrusion detection: fix ja4 option templating
• intrusion detection: fix and simplify grid search in download tab
• intrusion detection: fix downloads tab not loading with Tabulator
• intrusion detection: revert “fix downloads tab not loading with Tabulator”
• intrusion detection: make grids virtual to fix performance issues
• ipsec: fix regression in configuration write with introduced volatile fields
• ipsec: add firewall rules skip option for VTIs
• ipsec: deprecate legacy stroke and implement swanctl for overview
• ipsec: add default value to “make_before_break” that retains disabled default
• ipsec: fix bulk operations in SPD page
• ipsec: dots are not allowed in pool names
• ipsec: allow underscores in PSK identifiers
• isc-dhcp: show tracking IPv6 interfaces when automatically enabled and offer an explicit disable
• isc-dhcp: hide IPv4 menu items when Dnsmasq DHCP is enabled to improve out of the box experience
• isc-dhcp: add static mapping CSV export
• isc-dhcp: allow static mapping export for disabled entries
• kea-dhcp: honour IPv4 client specific reservation domain name option (contributed by NOYB)
• kea-dhcp: expose lease expiration settings to the GUI (contributed by Konstantinos Spartalis)
• kea-dhcp: support DHCP option 121 (classless static routes)
• lang: add Greek as a new language (contributed by Konstantinos Spartalis)
• lang: make more strings translate-able (contributed by Tobias Degen)
• lang: updates for Chinese, Czech, German and Greek
• lang: new Ukrainian language and assorted updates
• monit: move backend scripts directory
• monit: fix migration weirdness with run/post use
• openvpn: the server wizard functionality has been permanently removed as it required the old wizard implementation
• radvd: refine checks that ignored 6rd and 6to4
• wireguard: move backend scripts to proper location
• unbound: fix error in edge case of initial model migration
• unbound: configurable top domain list length in reporting view (contributed by Konstantinos Spartalis)
• unbound: remove unknown model reference and protect/simplify remaining one
• unbound: add support for TXT records in host overrides
• backend: trigger boot template reload without using configd
• backend: added IPv6 bracket helper for templates (contributed by BPplays)
• backend: add “!” operator to execute and flush cache when it exists
• mvc: introduce generic model caching to improve operational performance
• mvc: field types quality of life improvements with new getValues() and isEqual() functions
• mvc: filed types deprecated getCurrentValue() in favour of getValue() and removed isEmptyString()
• mvc: new BaseSetField() as a parent class for several other field types and numerous new and improved unit tests
• mvc: support chown/chgrp in File and FileObject classes
• mvc: use getNodeContent() to gather grid data
• mvc: allow PortOptional=Y for IPPortField
• mvc: remove SelectOptions support for CSVListField
• mvc: migrated use of setInternalIsVirtual() to volatile field types
• mvc: fix getDescription() in NetworkAliasField
• mvc: improve resilience of VPNIdField and LinkAddressField
• mvc: repair side affect of getDescription() change causing performance regressions
• mvc: modify existing and add missing descriptions in models
• mvc: set default validation message for CertificateField
• mvc: BaseModel: minor non-functional cleanups
• mvc: ModelRelationField: keep array structure in memory to avoid reinitiating object construction
• mvc: tweaked model definitions, especially descriptions and validation message style
• mvc: slightly adjust two getOption() calls in constraints
• mvc: BaseListField: always map values in getDescription()
• mvc: BaseListField: account for option container and passthrough value
• mvc: remove getCurrentValue() compatibility wrapper
• mvc: Backend: always return strings in configdRun() and configdpRun()
• mvc: improve replaceInputWithSelector() to support an empty placeholder
• mvc: setDefault() not fired as setValue() was set with an empty string
• mvc: allow empty responses to fix a regression due to stream output safety path addition
• mvc: remove empty string fallbacks for backend invokes that are no longer needed
• mvc: more style changes on existing core models
• mvc: disable Dnsmasq/Unbound template generation
• mvc: remove getDescription() overlay in ModelRelationField
• mvc: protect JSON response against UFT-8 encoding failures
• mvc: HTML-decode select element values
• rc: make changes to php,var,tmp bootstrap
• ui: switch from Bootgrid to Tabulator for MVC grid rendering
• ui: numerous switches to shared base_bootgrid_table and base_apply_button use
• ui: flatten nested containers for grid inclusion
• ui: use snake_case for all API URLs and adjust ACLs accordingly
• ui: move tooltip load event to single-fire mode
• ui: add checkmark to SimpleActionButton as additional indicator
• ui: improve menu icons/text spacing (contributed by Konstantinos Spartalis)
• ui: bootgrid: clean up leftover compatibility bits
• ui: bootgrid: add missing sortable option
• ui: bootgrid: provide more styling possibilities from formatters
• ui: fix language selection for low vertical resolution screens (contributed by Konstantinos Spartalis)
• ui: hide header of the picture widget on the dashboard (contributed by Konstantinos Spartalis)
• ui: bootgrid: add tabulatorOptions to translateCompatOptions()
• ui: bootgrid: raise rowCount default to 50 and adjust selections accordingly for most pages
• ui: bootgrid: simplify custom grid command additions
• ui: do not add an empty option into an empty option group
• ui: add datetime-local to field types
• plugins: replace variables in package scripts by default
• plugins: os-OPNBEcore 1.6 with OpenID Connect and scheduled jobs support
• plugins: os-OPNWAF 2.0 with OpenID Connect support, customizable error documents and updated rule set
• plugins: os-acme-client 4.10
• plugins: os-bind 1.34
• plugins: os-c-icap 1.9
• plugins: os-caddy 2.0.4
• plugins: os-clamav 1.8.1
• plugins: os-crowdsec 1.0.12
• plugins: os-dnscrypt-proxy 1.16
• plugins: os-etpro-telemetry 1.8 now shows more status responses in widget
• plugins: os-frr 1.47
• plugins: os-gdrive-backup 1.0 for Google Drive backup support
• plugins: os-grid_example 1.1 updates best practice on grid development
• plugins: os-netbird 1.0 (contributed by Gauss23 and Bethuel Mmbaga)
• plugins: os-netbird 1.1 fixes service startup and switches to syslog (contributed by Bethuel Mmbaga)
• plugins: os-nginx 1.35
• plugins: os-openvpn-legacy 1.0 for legacy OpenVPN components support
• plugins: os-puppet-agent 1.2
• plugins: os-shadowsocks 1.3
• plugins: os-smart 2.4 adds extended info option (contributed by poisonbl)
• plugins: os-squid 1.3
• plugins: os-strongswan-legacy 1.0 for legacy IPsec components support
• plugins: os-telegraf 1.12.13
• plugins: os-theme-advanced 1.1 (contributed by Jaka Prašnikar and Raushan Patel)
• plugins: os-theme-cicada 1.40 (contributed by Team Rebellion)
• plugins: os-theme-tukan 1.30 (contributed by Team Rebellion)
• plugins: os-theme-vicuna 1.50 (contributed by Team Rebellion)
• plugins: os-zabbix-agent 1.17
• plugins: os-zabbix-proxy 1.14
• src: FreeBSD 14.3-RELEASE-p4 plus assorted stable/14 networking commits
• src: add a new sysctl in order to differentiate UEFI architectures
• src: libarchive: merge version 3.8.1
• src: lagg: fix if_hw_tsomax_update() not being called
• src: wg: add support for removing allowed-ip entries and assorted cleanups
• src: ovpn: support multihomed server configurations and assorted cleanups
• src: netlink: fully clear parser state between messages
• src: udp: fix a inpcb refcount leak in the tunnel receive path
• src: p9fs: assorted fixes
• src: assorted network stack fixes via stable/14
• src: if_ovpn: support IPv6 link-local addresses
• src: if_ovpn: support floating clients
• src: if_ovpn: fill out sin_len/sin6_len
• src: if_ovpn: destroy cloned interfaces via a prison removal callback
• src: ifconfig: support VLAN ID in static/deladdr
• src: bnxt: fix the request length in bnxt_hwrm_func_backing_store_cfg()
• src: iflib: set the get counter routine prior to attaching the interface
• src: ifnet: defer detaching address family dependent data
• src: ixgbe: fix incomplete speed coverage in link status logging
• src: ixl: fix queue MSI and legacy IRQ rearming
• src: openssl: fix multiple vulnerabilities
• src: re: add PNP info for module
• src: re: make sure re_rxeof() is called in net epoch context
• src: vfs: fix copy_file_range() failing to set output parameters
• ports: curl 8.16.0
• ports: dnspython 2.8.0
• ports: expat 2.7.3
• ports: kea 3.0.1
• ports: krb5 1.22.1
• ports: libpfctl 0.17
• ports: lighttpd 1.4.82
• ports: nss 3.117
• ports: openssl 3.0.18
• ports: openvpn 2.6.15
• ports: pcre2 10.46
• ports: perl 5.42.0
• ports: php 8.3.26
• ports: phpseclib 3.0.47
• ports: py-duckdb 1.3.2
• ports: py-jq 1.10.0
• ports: py-requests 2.32.5
• ports: strongswan 6.0.1
• ports: sudo 1.9.17p2
• ports: suricata 7.0.12
• ports: unbound 1.24.0

A hotfix release was issued as 25.10_2:

• system: safeguard config history delete and revert by requiring HTTP POST method
• rc: make sure /var/lib/php/tmp can be accessed by “other” users
• plugins: os-OPNBEcore 1.7
• plugins: os-OPNcentral 1.12
• plugins: os-q-feeds-connector 1.2
• plugins: os-squid 1.4 works around CVE-2025-62168 (contributed by m.a.x. it)

Migration notes, known issues and limitations

• The captive portal implementation moves from IPFW to PF. Check the technical details first, especially regarding the new ruleset behaviours.
• Deprecated Google Drive backups due to upstream policy changes and moved to plugins for existing users.
• API URLs registered in the default ACLs have been switched from “camelCase” to “snake_case”.
• API grid return values now offer “%field” for a value description when available. “field” will now always be the literal value from the configuration. The API previously returned a display value for some field types, but not all.
• Reverted tunables “hw.ibrs_disable” and “vm.pmap.pti” to FreeBSD defaults when no explicit values have been set in tunables.
• Moved OpenVPN legacy to plugins as a first step to deprecation.
• Moved IPsec legacy to plugins as a first step to deprecation.

Original source