This business release is based on the OPNsense 26.1.9 community version with additional reliability improvements.

Here are the full patch notes for the initial release:

Initial release

• system: refactor dashboard to use User model instead of direct config access
• system: throw UserException when dashboard size limit was reached on save
• system: add notes dashboard widget (contributed by Konstantinos Spartalis)
• system: fix traffic dashboard widget initialization race condition (contributed by Greelan)
• system: avoid side effect rendering sysctl item in config.xml during console assignment
• system: improve cron command and parameter escaping
• system: support RADIUS NAS-IP-Address attribute for authentication
• system: add compatibility layer to future route disable/enable migration
• system: only split first colon when reading sysctls
• system: revisit snapshot name validation (partially contributed by Konstantinos Spartalis)
• system: fix missing newline when generating cron jobs due to a regression
• system: fix missing base64_decode() in JsonField which prevented user settings from saving
• system: link CA references after all changes
• system: parse certificate “key_type” and “digest”
• system: allow flushing legacy OpenVPN legacy config
• system: audit “staticroute” config access
• system: use safe config iteration in core_user_changed_groups()
• system: tighten landing page redirect (contributed by Konstantinos Spartalis)
• system: fix passing null into getRealInterface()
• system: fix regression in selective group delete introduced previously
• system: allow unregistered plugin cron actions to be deleted
• system: disable MAILTO for cron jobs
• system: dashboard: explicitly compact on layout shift if there is no predefined layout
• system: dashboard: update result on default restore
• reporting: render NaN values as empty values and omit leading empty records from data set for health graphs
• reporting: add max on Y axis for traffic graphs
• interfaces: refactor bridge reconfigure script
• interfaces: add missing config locks in device controllers
• interfaces: use safe iteration in backend code
• interfaces: adjust and annotate interface_dhcpv6_id()
• interfaces: account for multiple UUIDs in VIP deletion
• interfaces: more safe iteration through config_read_array()
• interfaces: fix wrong DUID-UUID format but keep accepting the wrong one
• interfaces: fix regression in selective device delete introduced previously
• interfaces: IAID selection and prefix range reservation for WAN DHCPv6
• interfaces: parse ifconfig output despite exit error in legacy_interfaces_details()
• interfaces: hostwatch: pin warning banner to enabled flag
• firewall: live view: decode HTML where necessary to aid filtering
• firewall: use save method from ApiMutableModelControllerBase for log command, move rule command and savepoint action
• firewall: safe config access in list_legacy_rules.php
• firewall: remove duplicated CSV button hook
• firewall: fix NPTv6 validation for empty external subnet
• firewall: make getRealInterface() a static utility function
• firewall: refactor searchRuleAction() to use the same filtering and sorting logic on MVC and legacy data
• firewall: fix inverted source/destination cosmetic issue in SNAT and One-to-One NAT grids
• firewall: fix search for floating rules in new rules GUI
• firewall: add an alias formatter to show content fields as “dynamic” when populated by other components
• firewall: fix Tabulator regression with alias batch delete
• firewall: use safe config iteration in interface registration
• firewall: fix unintended change in filtering logic for new rules GUI
• firewall: fix action, ipprotocol and protocol translations for legacy rules in new rules GUI
• firewall: use safe iteration over rules in filter_core_rules_user()
• firewall: add missing exclamation mark for “not” in scrub rules
• firewall: fix interface sorting by value for live log and groups
• firewall: add banner if no rules defined in new rules GUI to match legacy GUI
• firewall: use strnatcasecmp() for interface list in new rules GUI
• firewall: fix typo that prevented queues to be selectable in pf-based traffic shaping
• firewall: escape shaper targets in rule edit (contributed by lujiefsi)
• captive portal: remove redirection on HTTPS and ditch non-functional pass statement
• dnsmasq: change DHCP tag to DescriptionField
• dnsmasq: change widget link from settings to leases page
• firmware: opnsense-bootstrap: add “-B” bare bootstrap mode
• firmware: add repo configuration output to connectivity audit
• firmware: stop buffering in sed to fix chunked update log output
• firmware: retain ordering in update servers for connectivity check
• firmware: allow “local” business mirror subscription
• firmware: put clickable trailer for community plugins
• firmware: fix return value masking during updates
• firmware: opnsense-update: do not clean obsolete files on manual -r invokes
• intrusion detection: fix drop and alert buttons on rules tab
• ipsec: move swanctl.conf download button to the tab
• ipsec: restyle the connections page for clarity
• ipsec: disable scroll in authentication and children grids (contributed by Konstantinos Spartalis)
• ipsec: validate the use of refid in CA certificates (reported by lujiefsi)
• kea: fix “Delegated length must be longer than or equal to prefix length” validation
• kea: add ddns-override-no-update, ddns-override-client-update and ddns-update-on-renew per subnet
• kea: DDNS DNS server port can now be specified
• kea: add explicit reverse DDNS zones support (contributed by XtraLarge)
• kea: add DDNS manual config override
• kea: remove depend constraint of ddns_reverse_zone
• kea: plug socket into dynamic PD route installation script
• kea: add prefix to reservations to allow for static PD allocations based on DUID/MAC
• kea: infer IPv6 lease type in delete script via lease lookup so IA_NA/IA_PD can be deleted
• kea: DDNS add ddns-conflict-resolution-mode per subnet (contributed by chaispaquichui)
• kea: allow customizing “mac_sources” and change default to “ipv6-link-local”
• kea: add user-context object to config to emit description
• kea: fix option_data_autocollect mismatch in DHCPv6 page
• kea: enable internalModelSafeDelete due to increased model relation field usage
• kea: build reservation status from control socket output
• kea: add subnet vltime (partially contributed by Brandan Giles)
• kea: add client-id to DHCPv4 reservations
• kea: use JSON_UNESCAPED_UNICODE when writing the JSON configuration
• kea: dynamic prefix delegation support
• kea: always start the prefix watcher when DHCPv6 is enabled
• kea: cleanups for IntegerField using isSet() and no negative numbers allowed
• network time: small cleanups in ntpd_configure_gps()
• openvpn: add tls-crypt-v2 support
• openvpn: allow restart action via cron
• openvpn: fix client export not showing common names
• openvpn: require an integer of at least 1 for “vpnid” field
• radvd: allow user controlled hop limit (contributed by BPplays)
• radvd: allow to start a manual configuration without primary IPv6
• unbound: improve hostname/domain override validation
• unbound: minor style/refactor for safe config access
• unbound: hide unused tree row in form output for overrides
• unbound: restyle statistics page
• unbound: blocklists categorization and apply button message update (contributed by Konstantinos Spartalis)
• wireguard: use getValues() consistently in control script
• acl: some missing references and using camelCase pointers instead of snake_case
• backend: configctl: properly quote parameters to avoid skipping empty ones (contributed by Majx)
• backend: configctl: support -f cache flush parameter to fix cache invalidation preamble “!” pass
• lang: numerous updates and fixes in existing languages
• mvc: introduce JSON field type and refactor dashboard to use it
• mvc: fixed a number of class import statements
• mvc: remove unused UIModelGrid imports in IDS, Monit and Syslog controllers
• mvc: remove Util imports where not needed
• mvc: BaseField: add count() helper
• mvc: fix validation to use getValue instead of plain string cast
• mvc: UIModelGrid: remove flatten() method as getFlatNodes() is almost the same
• mvc: add support for pluggable dynamic menu items and move some existing parts out of the MenuSystem class
• mvc: stricter email address validation
• mvc: OptionsField: use key as value if no value is set
• mvc: unify migration message returns
• mvc: add new validators to TextField: AllowSpaces, AllowNewlines, AllowSpecial and introduce new StrictTextField
• mvc: strict alphanumeric-only regex for certificate refid (contributed by eev4n)
• mvc: simplify assorted option values to reduce duplication
• mvc: static header support for forms
• rc: move system_powerd_configure() to bootup plugin hook
• shell: config access refactor in password and setaddr scripts
• shell: safe iteration for VLAN/LAGG in port assignment
• shell: use safe config iteration in live mode banner
• shell: fix syntax error in port assignment
• ui: generalize placeholders between controllers and JS
• ui: simplify and clean up debounce() usage
• ui: trap generic error popup for specific API URLs such as /api/core/firmware/upgradestatus when it adds no value and known to be unstable
• ui: add static dialog header support and fix bool/string compare
• ui: add type_formatter keyword to form rendering
• ui: add save/cancel button support to form rendering
• ui: remove “event” use from bootgrid showSaveAlert()
• ui: add support for binary file uploads
• ui: bootgrid: onRendered executed in wrong spot
• ui: allow passing of data attributes for select items in setFormData()
• ui: remove banner on inline reload if applicable
• ui: button padding when injecting next to apply button
• ui: fix spurious padding in apply button section (contributed by Konstantinos Spartalis)
• plugins: os-cloudflared 1.0 (contributed by Richard Aspden)
• plugins: os-ddclient 1.31
• plugins: os-frr 1.53
• plugins: os-netbird 1.3
• plugins: os-q-feeds-connector 1.6
• plugins: os-rfc2136 1.10
• plugins: os-stunnel fix for missing include in script
• plugins: os-telegraf 1.12.15
• plugins: os-tinc fixes evaluation of hosts enabled flag (contributed by Konstantinos Spartalis)
• plugins: os-turnserver 1.3
• plugins: os-zabbix-agent 1.9
• plugins: os-zabbix-proxy 1.7
• plugins: use safe config iteration in interface registration code
• src: missing permission check in thr_kill2
• src: arbitrary file overwrite via the KTLS receive path
• src: multiple vulnerabilities in the sound mmap path
• src: sigqueue missing capability mode restriction
• src: use-after-free bug in the IPV6_MSFILTER socket option handler
• src: flaw in Linuxulator execution of setugid binaries
• src: ASLR bypass for setuid executables via procctl
• src: integer overflow in vt CONS_HISTORY ioctl
• src: openssl: fix multiple vulnerabilities
• src: ldns: fix query response validation
• src: netlink: fix lock leak in nl_find_nhop
• src: pf: avoid taking the pf rules write lock in a couple of ioctls
• src: ipfw: add ability to run ipfw binary with 15.0+ kernel module
• src: ipfw: treat ipv6 address with zero mask as “any”
• ports: curl 8.20.0
• ports: dnsmasq 2.93
• ports: filterlog 0.8 changes rule label fetch to libpfctl
• ports: kea 3.0.3
• ports: krb5 1.22.2
• ports: libxml 2.15.3
• ports: nss 3.124
• ports: openssh 10.3p1
• ports: openssl 3.0.21
• ports: openvpn 2.7.4
• ports: phalcon 5.14.2
• ports: php 8.3.31
• ports: phpseclib 3.0.55
• ports: py-duckdb 1.5.3
• ports: py-numpy 2.4.6
• ports: py-requests 2.33.1
• ports: python 3.13.14
• ports: sqlite3 3.53.1
• ports: strongswan 6.0.7

Here are the full patch notes for patch release 1:

Patch release 1

• system: configuration line injection via multiple GUI text fields (reported by lujiefsi)
• system: add missing legacy_html_escape_form_data() for $a_cert on administration settings (reported by Jonas Ampferl of Hacking Cult)
• system: lockout: address newline injection and correct IP parsing (reported by lujiefsi)
• system: hasPrivilege() not merging user privs correctly (reported by iys8)
• system: fix ACL pattern for carp_status action (contributed by Etienne Girault)
• interfaces: prohibit the use of advanced DHCP option settings by non-administrators
• firewall: safeguard ISO country codes in alias download (reported by Jonas Ampferl of Hacking Cult)
• firewall: escape user-controlled values in tooltip attributes (reported by Jonas Ampferl of Hacking Cult)
• firewall: unify group names of OpenVPN, WireGuard and IPsec encapsulation
• firewall: skip alias on new rules GUI apply
• captive portal: pass in ip_address as a set for accounting
• firmware: fix small glitch that re-prompts for showing community plugins
• network time: fix stored XSS in GPS init string display (reported by Jonas Ampferl of Hacking Cult)
• openvpn: prevent path traversal in “common_name” attribute (reported by lujiefsi)
• openvpn: escape client common_name in connection-status views (reported by Jan Kahmen of turningpoint and lujiefsi)
• mvc: checkAndThrowValueInUse validate input token which may only contain alphanum and dashes (reported by Jonas Ampferl of Hacking Cult)
• mvc: also do not translate empty labels in grids
• ui: add generic escaping function htmlSafe() for JavaScript
• src: vm: use-after-free in device pager page list
• src: execve: local privilege escalation via execve(2) TOCTOU race
• src: openzfs: multiple vulnerabilities in OpenZFS
• src: libalias: bffer overflow in libalias RTSP handler
• src: unlinkat: unlinkat(2) ignores AT_RESOLVE_BENEATH flag
• src: tcp: use-after-free in TCP RACK stack option handler
• src: posixshm: multiple vulnerabilities in POSIX largepage objects
• src: audit: incorrect audit records for ptrace(2) syscall requests
• src: ktls: remote DOS via uninitialized memory access in KTLS receive
• src: linux: kernel stack disclosure in Linux compatibility layer
• src: iconf: multiple vulnerabilities in iconv(3)
• ports: expat 2.8.2
• ports: ldns 1.9.2

A hotfix release issued as 26.4.1p1_2:

Hotfix release issued as 26.4.1p1_2

• firmware: support for patch release matching
• openvpn: add a specific regex constraint for static keys to fix previous safeguarding

A hotfix release issued as 26.4.1p1_3:

Hotfix release issued as 26.4.1p1_3

• openvpn: further fix validation for auth token secret and static key

The OPNsense business edition transitions to this 26.4 release including full MVC/API experience as automation rules have been promoted to the new rules GUI, Suricata with a new inline inspection mode using “divert”, assorted IPv6 reliability and feature improvements, router advertisements MVC/API, full code shell command escaping revamp, default IPv6 mode now using Dnsmsaq for client connectivity, Unbound blocklist source selection, an automatic host discovery service, captive portal IPv6 support plus much more.

Please make sure to read the migration notes before upgrading.

Download link is as follows. An installation guide and the checksums for the images can be found below as well.

https://downloads.opnsense.com/

This business release is based on the OPNsense 26.1.6 community version with additional reliability improvements.

Here are the full patch notes:

system

• factory reset and console tools now default to using Dnsmasq for DHCP
• wizard now offers an abort button and deployment type selections
• wizard can disable WAN or LAN interface now
• provide resolv.conf overrides via /etc/resolv.conf.local
• add XMLRPC option for hostwatch
• remove “upstream” from gateway grid as priority already reflects the proper data
• adjust gateway group priority (tier) wording
• add note field to store comments for each snapshot
• add configurable “memberOf” attribute to LDAP connector
• do not scrub unrelated IPv6 DHCP ranges from Dnsmasq LAN config during wizard
• adapt DHCP address shell setup for new config access functions
• adapt web GUI certificate renew for new config access function
• adapt initial port configuration DHCP setting for new config access functions
• avoid using “(system)” user revision annotation to match legacy and MVC code
• fix log files ‘go to page’ edge case and row count persistence/max
• ignore future backups when they exist to ensure new backups are saved
• ensure proper types are emitted in searchGatewayAction() when configd action fails
• use safe iteration for cert/ca in system_trust_configure()
• fixed broken link in modal header when using HA and saving administration settings
• create a backup on factory reset
• unify pwd_changed_at usage
• store dashboard layout types based on column breakpoints
• do not show snapshot notes in the grid
• use safe config iteration in admin settings page
• cleanup and simplify certificate deployment and remove legacy config import
• validate monitor uniqueness based on the host route presence
• simplify user/group sync scripts using config_read_array()
• dashboard gauge improvements (contributed by Konstantinos Spartalis)
• compress height of the log viewer grid

reporting

• restore canvas state in health graph to fix Firefox display bug
• use safe config iteration in RRD code

interfaces

• a new IPv6 mode called “Identity association” was added
• add and enable new host discovery feature for neighbours via hostwatch
• settings page was migrated to MVC/API
• handle hostwatch user/group via package
• force-reload IPv6 connectivity when PDINFO changes during renew
• dhcp6c rapid-commit, request-dns and config write refactoring
• generalise the rtsold_script code
• use descriptive interface names in automatic discovery table
• harden settings page with file_safe() and allowed_classes=false
• host discovery: make sure the full dump includes NDP output on fallback
• fix migration for IPv6 no-release option
• fix wlanmode argument usage
• generalise the dhcp6c_script using the new IFNAME variable
• fix enter key in assignment description and general cleanup
• protect device reads against forcing empty arrays into $config
• remove unused ip_in_interface_alias_subnet()
• use safe config iteration in PPP edit page
• clean up overview UI code and fix CARP badge alignment
• simplify CARP scripts using config_read_array()
• automatic dhclient recovery
• settings page use cases for config_read_array()
• configurable cleanups for automatic neighbor discovery via hostwatch
• refactor PPP CARP hook

firewall

• escape selector in rule_protocol
• “Port forward” was migrated to “Destination NAT” MVC/API
• unified look and feel of MVC/API pages formerly known as “automation”
• improved support of gateway groups in policy-based routing
• plugin support for “ether” rules has been removed
• add import/export to shaper queues and pipes
• “divert-to” support in new rules GUI
• added a rule migration page (use with care)
• make previously associated DNAT rules editable
• FilterBaseController requires BaseUserException
• fix typo with sprintf() with DNAT rule
• fix target mapping inconsistency leading to references not being processed in destination NAT
• use local-port as target when specified in destination NAT
• fix missing reply-to when not specifically set in new rules
• live view: fix parsing of combined filters stored as converted strings
• fix group rename in source_net, destination_net and SNAT/DNAT target fields
• add tcpflags_any in new rules GUI for parity with legacy rules
• exclude loopback from interface selectpicker in new rules GUI
• well known ports added to filter rule selection
• undefined is also “*” in new rules grid
• add download button for validation errors in rule import
• allow TTL usage on host entries
• add missing implementation for “disablereplyto” in new rules
• fix encoding issue in dashboard widget
• check for schedules in use in new rules
• add import/export function and missing lock on set action
• better focus selected alias updates to in crease performance when either –aliases or –types is used
• implement missing ICMP types in new rules GUI (contributed by Bjoern Jakobsen)
• adjust for parseReplace() for icmp-type “skip”
• fix NAT rule enabled checks display (contributed by Aaron Rogers)
• prevent separator char from being used in category names
• fix running into error using well known protocols with “-” in them
• add validation to prevent using both gateway and reply-to in the same rule in new GUI
• add a command button to open the live log with pre-filled rule ID in new GUI
• move download and upload commands out of partial into global commands in new GUI
• reduce complexity in URL hash handling and when using firewall_rule_lookup.php in new GUI
• fix default ipprotocol mismatch so that when not specified both are indicated
• update destination NAT ACL to match our menu entry
• fix issues with searching in the states page
• allow well known ports in local-port destination NAT
• adjust row selection behaviour for internal rules in MVC pages
• offer aliases the same was as the field type expects them
• fix access to deleted filter node in advanced settings
• merge MVC NAT page templates into a single one
• when repopulating the interface selectpicker, always restore current selection in new rules GUI
• remove hardcoded colors where possible in new rules GUI
• fix category colors in new rules GUI
• merge read of groups and interfaces in new rules GUI
• make MVC protocol selection match the old rules pages
• add model validations for common errors in destination NAT
• live view: allow regex use in “contains” cases
• live view: fix SyntaxWarning in log reader backend
• use safe iteration in old rule page for schedule lookup
• use safe config iteration in outbound NAT page
• fix regression in alias summary not shown in new rules GUI
• invalidate database when last updated time is in the future
• add missing “static port” option in source NAT
• add semantic groups coloring option in dashboard widget (contributed by Gunnar Lieb)
• add missing alias rename rule targets
• add alias GeoIP database update button and move bogons one to the same tab
• fix port handling in registered NAT rule
• fix MVC code vs. legacy rules display issues
• outbound NAT page use case for config_read_array()
• fix wrong “pass” on DNAT rule when using register rule
• adjust sort order in networks and aliases in new rules GUI
• change sorting to interface/group name and stop caring about counted rules in new rules GUI
• change category sorting using names instead of counted rules in new rules GUI
• remove tokenizer from categories and use selectpicker instead in new rules GUI

captive portal

• cleanup and simplify certificate deployment and remove legacy config import
• enforce POST-only on logoffAction() (contributed by Oliver Jueguen)
• add IPv6 support (partially contributed by Alex Goodkind)
• fix allowed addresses missing from session IPs in roaming case

dhcrelay

• relax the check for present addresses and CARP-related cleanups

dnsmasq

• add automatic RDNSS option when none is configured
• fix log conditions
• add IP address validations for some of the DHCPv4 and DHCPv6 options (contributed by Greelan)
• add “no-ping” option (contributed by Konstantinos Spartalis)
• remove a too-strict validation for suffix IPv6 addresses without constructor use
• ensure the lease view handles client-id correctly
• prevent “*” from being collected as “client_id”

firmware

• opnsense-code: run configure script on upgrade if needed
• revoke 25.7 fingerprint
• fix automatic advanced toggle in settings
• shorten the reboot message to fit the spinner on the same line
• tweaks for update/upgrade cleanup behaviours between core and opnsense-update
• add support for aux repository handling in opnsense-update
• add aux repository support
• repeat the update after pkg reinstall

installer

• ufs: ignore errors when flushing the full disk

intrusion detection

• add a “divert” intrusion prevention mode
• upgrade ET Open ruleset to version 8.0 (contributed by 0nnyx)

ipsec

• expose ChaCha20-Poly1305 AEAD proposals in IKEv2 (contributed by Kota Shiratsuka)
• use safe config iteration for VIP lookup
• add 4 insecure proposals for compatibility (contributed by Bjoern Jakobsen)

kea

• add libdhcp_host_cmds.so to expose internal API commands for reservations
• exit prefix watcher script if no lease file exists
• allow “hw-address” for reservations
• add pool in subnet validation
• minor code cleanups in model code
• fix subnets GUI missing root node
• add required scope to prefix watcher link local address route
• guard prefix watcher when no link-local address exists for a route that should be installed
• add DDNS and DHCP option support
• add DDNS subnet-specific qualifying suffix and prevent updates if no server is set
• add sockets max-retries and retry-wait-time options
• add delete lease command and use socket for up-to-date lease collection
• move pool-in-subnet validation logic mostly to KeaPoolsField
• remove KeaCtrlAgent dependency on HA configuration
• use SetConstraint for match_data to allow 0 as valid value

monit

• use safe config iteration in gateway alert script

network time

• add pool property for time servers (contributed by Konstantinos Spartalis)
• remove stale symlink when PPS is disabled

openvpn

• removed the stale TheGreenBow client export
• add options for legacy ciphers (contributed by Bjoern Jakobsen)
• debounce learn-address calls to limit the number of alias updates to a minimum
• add validation for selecting username as CN without setting any authentication

radvd

• migrated to MVC/API
• remove faulty empty address exception
• remove configuration file if disabled
• implement RemoveAdvOnExit override
• add Base6Interface constructor
• support nat64prefix
• change tabs to spaces in radvd.conf for better maintenance
• use safe config array iteration over virtual IPs
• when adding a manual instance for an automatic “track6” interface do not ignore its settings

unbound

• safeguard the blocklist tester against empty configuration testing
• persist overrides PTR configuration and allow the user to deselect it
• split logic in update_blocklist() and simplify getPoliciesAction()
• move policy fetch to the controller and clean up accordingly
• only emit warning when “addptr” was requested
• use expand formatter for blocklist URLs and DNSBL types
• include blocklist length in state change logic
• add harden below NXDOMAIN option (contributed by Konstantinos Spartalis)
• consolidate override aliases into tree view
• deprecate Blocklist.site blocklists (contributed by Drumba08)
• clean up blocklists update marker and size file handling
• add per-policy quick actions in reporting overview
• improve CNAME handling of whitelisted domains
• safe command execution changes
• merge extended blocklists into community version
• prevent caching of blocklist entries on overlapping subnet policies
• notify user if a blocklist reset is required
• reconfigure if marker file present

backend

• safe execution changes in the whole code base
• removed short-lived mwexecf_bg() function
• allow non-intrusive config_read_array() and fix a gateway group delete issue with it
• removed mwexec() and mwexec_bg() functions following their deprecation
• add config_push_array() and config_merge_array() helpers
• remove constant configd cleanups as they may influence requests from other threads executing different commands
• remove unused examples throwing errors now
• fix configd using a new temporary file for cached items
• more fixes for re-bound SyntaxWarning throws in Python 3.13
• use config_read_array() non-insert mode mode iteration of virtual IPs

lang

• various translation updates
• various language updates

mvc

• add ChangeCase support to ProtocolField for DNAT special case
• improve importCsv() to support either comma or semicolon
• removed long obsolete sessionClose() from ControllerRoot
• BaseModel: isEmptyAndRequired() has been removed
• removed unusued RegexField
• add $separator as parameter for CSV export and switch the default to a semicolon
• InterfaceField: minor adjustments and add resetStaticOptionList()
• catch empty data in CSV import
• restructure menu items and system using findNodeByPath()/getItem() additions
• BaseListField: generic implementation of static options
• PortField: make “well-known” port numbers known by allowing them to be mapped to their respective numbers
• collect UUID field so it can be searched, but only if the searchPhrase contains a valid UUID
• move CertificateField, InterfaceField and ProtocolField to newer static option API
• BaseListField: merge remaining use of shared implementation of static options
• File: add file_update_contents() helper
• Shell: rewrite exec_safe() to avoid vsprintf() complications
• BaseListField: replace empty() check with isSet() for proper selection of value “0”
• HostnameField: show string that failed validation by default
• BaseField: add setValues() for generic use
• add SetConstraint for problematic “0” value constraining
• ApiMutableModelControllerBase: remove unused error returning in setActionHook()

rc

• replace camcontrol with diskinfo for TRIM check (contributed by Maurice Walker)
• speed up maintenance file deletes

shell

• opnsense-log now supports “backend” and “php” aliases
• improve config restore UX using diff and additional meta data display

tests

• Shell: add testing framework
• merge stable filter tests to double check upcoming changes

ui

• allow HTML tags in menu items and title
• improve user readability in SimpleFileUploadDlg()
• batch bootgrid enable/disable-selected toggle by default
• swap order of custom bootgrid commands placement making sure they participate in command binding
• remove two unused static PHP array definitions
• Bootgrid: split row selection behavior into rowSelection boolean
• Bootgrid: force a lightweight redraw when columns are programmatically changed
• Bootgrid: require selection to be enabled for delete-selected
• bootgrid: introduce ‘expand’ formatter to cap lists of data
• set visibility hidden for base_bootgrid_table
• upgrade Tabulator to version 6.4.0
• automatic grid height calculation
• bootgrid: maintain scrolling position for both datatree and command actions

plugins

• os-acme-client 4.15
• os-caddy 2.1.0
• os-ddclient 1.29
• os-freeradius 1.10
• os-frr 1.51
• os-haproxy 5.1
• os-isc-dhcp 1.0
• os-netbird 1.2
• os-nextcloud-backup 1.2
• os-nginx 1.36
• os-postfix 1.24.1
• os-q-feeds-connector 1.5
• os-tailscale 1.4
• os-tayga 1.5
• os-theme-cicada 1.41 (contributed by Team Rebellion)
• os-theme-flexcolor 1.1 (contributed by Schnuffel2008)
• os-theme-tukan 1.31 (contributed by Team Rebellion)
• os-theme-vicuna 1.51 (contributed by Team Rebellion)
• os-turnserver 1.2
• os-upnp 1.9
• os-wazuh-agent 1.3

src

• assorted patches from stable/14 for LinuxKPI, QAT, and network stack
• if_ovpn: use epoch to free peers
• carp6: revise the generation of ND6 NA
• igmp: do not upgrade IGMP version beyond net.inet.igmp.default_version
• igmp: apply net.inet.igmp.default_version to existing interfaces
• ice: handle allmulti flag in ice_if_promisc_set function
• icmp6: clear csum_flags on mbuf reuse
• divert: Use a better source identifier for netisr_queue_src() calls
• if_ovpn: add interface counters
• e1000: fix setting the promiscuous mode
• pfctl: allow new page character (^L) in pf.conf
• sctp: support bridge interfaces
• ifconfig: assorted stable fixes
• ip_mroute: assorted stable fixes
• vtnet: assorted stable fixes
• pf: silently ignores certain rules (reported by [18])
• vnet: ensure the space allocated by vnet_data_alloc() is sufficent aligned
• ifnet: Fix decreasing the vnet interface count
• e1000: Increase FC pause/refresh time on PCH2 and newer
• net80211: fix VHT160/80P80/80 chanwidth selection in the “40-” case

ports

• curl 8.19.0
• dhcp6c v20260122
• expat 2.7.4
• hostwatch 1.0.13
• ldns 1.9.0
• libucl 0.9.4
• libxml 2.15.2
• nss 3.121
• openldap 2.6.13
• openssl 3.0.20
• openvpn 2.6.19
• perl 5.42.2
• phpseclib 3.0.50
• py-duckdb 1.5.0
• python 3.13.13
• strongswan 6.0.4
• suricata 8.0.4
• syslog-ng 4.11.0

A hotfix release was issued as 26.4_6

• system: protect popen() with exec_safe() (contributed by Konstantinos Spartalis)
• system: lockout bypass fix (contributed by Konstantinos Spartalis)
• system: allow gateway load balance weights from 1 to 10 for more flexibility (contributed by Matthew Hall)
• system: add “nosync” option to gateway configuration
• firewall: fix typo in alias update error log and make parser a bit more resilient
• firmware: opnsense-update: handle FreeBSD.conf disable internally
• plugins: os-acme-client 4.16
• src: vm_fault: reset m_needs_zeroing properly
• src: timerfd: Fix interval callout scheduling
• src: tty: avoid leaving dangling pointers in tty_drop_ctty()
• src: pkru: fix handling of 1GB largepage mappings
• src: contrib/tzdata: import tzdata 2025c, 2026a and 2026b
• src: amd64: fix INVLPGB range invalidation
• src: pf: improve SCTP validation
• src: execve: fix an operator precedence bug
• src: dhclient: check for unexpected characters in some DHCP server options
• src: dhclient: fix reallocation of dhclient script environments
• src: libnv: switch fd_wait() from select(2) to poll(2)
• src: libnv: fix heap overflow in nvlist_recv()
• src: libpcap: update to 1.10.6
• src: ipfw_nptv6: fix handling the ifaddr removal event
• src: if_tuntap: make SIOCIFDESTROY interruptible
• src: pfctl: parser must not ignore error from pfctl_optimize_ruleset()
• src: pf: fix duplicate rule detection for automatic tables
• src: openssl: update from 3.0.16 to 3.0.20
• src: routing: fix use-after-free in finalize_nhop
• src: ixgbe: fix MRQC register value
• src: in_mcast: Fix a lock leak in inp_set_source_filters()
• src: linuxkpi: fix an off-by-one error in the kfifo implementation
• src: sctp: fix so_proto when peeling off a socket
• ports: expat 2.8.0
• ports: openvpn 2.6.20
• ports: strongswan 6.0.6

A hotfix release was issued as 26.4_14

• system: properly escape username in sync_user.php command invoke (contributed by Konstantinos Spartalis)
• system: fix XMLRPC sync with VIP and “nosync” option
• interfaces: safeguard DHCPv4 settings against arbitrary command injection (reported by Kchigo)
• captive portal: re-introduce hash lookup for accounting purposes
• captive portal: reload IPFW on captive portal reconfigure too
• dnsmasq: ignore DHCP names for “wpad” to fix CERT Vulnerability VU#598349
• network time: fix ACL definitions (contributed by Konstantinos Spartalis)
• openvpn: reload configuration for group sync after successful authentication
• ports: dnsmasq 2.92rel2
• ports: expat 2.8.1

A hotfix release was issued as 26.4_20

• system remove unused data-tooltip that is not properly escaped from certificates widget
• interfaces: dhclient.conf does not cope with multi-line request/require
• firewall: fix for missing HTML escape in description render in legacy rules GUI
• monit: sanitize monit output before offering it
• network time: cleanse port option before use (reported by Konstantinos Spartalis)
• mvc: do not translate empty strings
• src: dhclient: improve server and filename validation
• src: setcred: fix buffer overflow
• src: kern: make sure to drain selinfo sleepers
• src: fusefs: handle buggy server LISTXATTR response
• src: ptrace: fix validation of PT_SC_REMOTE arguments
• src: libcasper: switch from select(2) to poll(2)
• src: cap_net: do not allow new limits to drop keys from the old ones
• src: ipfw: fix parsing error in nat config port_range
• src: ipfw: fix checksum after NAT
• src: src: igmp: Avoid leaving dangling pointers in the state-change queue
• src: vxlan: Update *m0 after a pullup
• src: routing: use a better error number in sysctl_fibs()
• src: routing: initialize V_rt_numfibs earlier during boot
• src: pfsync: reject invalid SCTP states
• src: pf: do not reject rules with colliding hashes
• src: rtnetlink: check for allocation failure in nlattr_get_multipath()
• src: rtnetlink: align RTA_MULTIPATH length validation in nlattr_get
• ports: suricata 8.0.5
• ports: unbound 1.25.1

Migration notes, known issues and limitations

• ISC-DHCP moves to a plugin. It will be automatically installed during upgrades. It is not installed on new installations because it is not being used, but you can still install and keep using it.
• To accommodate the change away from ISC-DCHP defaults the “Track interface” IPv6 mode now has a sibling called “Identity Association” which does the same except it is not automatically starting ISC-DHCPv6 and Radvd router advertisements to allow better interoperability with Kea and Dnsmasq setups.
• Dnsmasq is now the default for DHCPv4 and DHCPv6 as well as RA out of the box. One thing that the upstream software cannot cover is prefix delegation so that is no longer offered by default. Use another DHCPv6 server in this case.
• Due to command line execution safety concerns the historic functions mwexec_bg() and mwexec() were removed. Make sure your custom code is not using them and use mwexecf(), mwexecfb() and mwexecfm() instead.
• The function sessionClose() has also been removed from the MVC code and is no longer needed. Make sure to remove it from your custom code.
• The custom.yaml support has been removed from intrusion detection. Please migrate to the newer /usr/local/etc/suricata/conf.d override directory.
• The new host discovery service “hostwatch” is enabled by default. You can always turn it off under Interfaces: Neighbors: Automatic Discovery if you so choose.
• The firewall migration page is not something you need to jump into right away. Please make yourself familiar with the new rules GUI first and check the documentation for incompatibilities. Single interface from the floating interface will not be considered “floating” in priorities.
• Firewall: NAT: Port Forwarding is now called “Destination NAT”. Firewall rule associations are no longer supported, but the old associated firewall rules remain in place with their last known configuration and can now be edited to suit future needs.
• Firewall: NAT: Source NAT is from the set of pages formerly known as automation, but Outbound NAT is still the main page for these types of rules.
• Unbound blocklists are now the same between business and community version. This requires a manual reapply of the blocklists in order to use the new shared format.

The public key for the 26.4 series is:

# -----BEGIN PUBLIC KEY-----
# MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEArTnFQp0jjj5bkLNx9G1j
# q26WmN/EtAaJUt+2MY8W8h7L3kokRMlTgEvCYJOkUjbJYbjuG0Cut3JExNYa1vdD
# 1SLIlJShyI8OsjbAS/flZdJB9c0Vxz2CwpoX9Efmp5TaB3GWqhHS0OVLx4MSI3HJ
# qP/aQLjZMuCQHX8beUQB77YWcT6sPC5UMYeNEW1uHR7Oki/TpOXWnzNStEQXRL6/
# MiuYJovedlNXeNUeebJyG0TyLJ/3uGMYhHKYK+OJkB03P3iLGGVE/WWNugsqX6bY
# tTU9PquHo5zDApndp8iG49Fs/DC0r7V1P85ETPtW2SuZQ7YeDuz3VKvuMxAqyQoC
# 1FLOsIuEfudDmRuMuTsRgB6jaGACEWUTuRyiFG4+kVDi1/qOWpYatP8C8B7Lx9UU
# CTZhCl+Se4woWGtp5KOtYe+pvJ4oz40SL4drUQFEP3ZOsK/HzyLjPFRgxfANNUPG
# ONayKHJXVVFPg2ATk9jeNPsLmXlcDmi/rihyN4RM2w0/bi8BWSc+dMGZ5ZhNJdsF
# wHBIscgpiAhs+HS8Usxy3idv/JkY0h9tZ2QnljhUUwhYV+DT9yZf5ABU0B68VjJ4
# /GloUc3bS7HBeSTAauYMOQvgkY1vcySGWTXvsGOw/Crpk4DYx5KpGNYHmENRey2c
# AQdi+Fvi3fFkV1BoxGo78NcCAwEAAQ==
# -----END PUBLIC KEY-----

SHA256 (OPNsense-business-26.4-dvd-amd64.iso.bz2) = 201fa8fb384fda534853f2a0fbc82aecbb8753e37a77426f55a1478029b02a2e
SHA256 (OPNsense-business-26.4-nano-amd64.img.bz2) = e133243e85aa630d00d29ea78b8f6fe3b87de06bd7e62f88c3c8fed1b51edb9e
SHA256 (OPNsense-business-26.4-serial-amd64.img.bz2) = 44dfd3a696bd04961145e40478128b75d911f0e8d6a9ea2a6d20a3b6205c7bc5
SHA256 (OPNsense-business-26.4-vga-amd64.img.bz2) = 52c4d12b87c5464f9bfff9124a6c3a1c1dd52bb9a6a16d8e5b5cdeee4f108c78

This business release is based on the OPNsense 25.7.10 community version with additional reliability improvements, but without revamped Unbound blocklists for the time being.

Here are the full patch notes:

system

• gateway monitor Shell class use et al
• no longer back up DUID but add compatibility glue to opnsense-importer
• replace exec() in config encrypt/decrypt
• replace history diff exec() with shell_safe()
• safe execution tweaks in rc.routing_configure
• fix log keyword search regression introduced in 25.7.7
• clean up and normalise the sample config.xml
• replace “realif” variables with “device” in gateway code
• replace exec() in live banner SSH probe
• add tooltip explaining active status in snapshots
• add “lazy loading” model support on TrustCert
• properly fill DNS SAN from existing certificates (contributed by Klaas Demter)
• rename sudoers file to make it more sortable (contributed by David Jack Wange Olrik)
• numerous safe execution changes
• sort to retain order in syslog-ng source definitions
• fix edge case in tunable reset with one single tunable in the default config

reporting

health

• add CPU temperature y-axis label (contributed by NOYB)

interfaces

• scan pltime/vltime in “ifconfig -L” mode
• fix comparison in PPP check code during assignment
• prefer longer lifetimes if multiple exist
• defer manual rtsold script execution
• use mwexecfb() in two instances
• move configure_interface_hardware() to main file
• migrate “sharednet” setting to its respective sysctls

firewall

• run filterlog directly after rules apply and remove promiscuous mode
• allow setting a custom authentication HTTP header for alias URL fetch (contributed by nox-404)
• for better IPv6 PMTU let “timex” and “paramprob” ICMP types through
• safe execution changes in rules reloading code
• safe execution changes in rc.filter_synchronize
• aliases: add has_parser() to check if an alias has a valid parser available
• live log: allow column modifications and combine hostname columns
• live log: add bigger table size options and simplify table update
• minor simplification in filter sync script
• automation: only show ICMP type when protocol is ICMP
• automation: add multi-select ICMP6 options
• simplify port alias check
• improve GeoIP alias expiry condition
• prevent autocomplete in alias auth password

captive portal

• re-introduce ipfw for accounting purposes only
• assign empty array when “interface list arp json” returns invalid JSON

dhcrelay

• add CARP VHID tracking option to relays
• use the new mwexecf() $format support
• reload table to update relay status

dnsmasq

• minor tweaks in lease commands
• add DHCP logging flags to influence log verbosity

firmware

• Shell class replacements in scripting

intrusion detection

• refactor query scripts and deprecate params.py
• increase maintainability of suricata.yaml file
• add support for /usr/local/etc/suricata/conf.d directory
• clean up views and controllers
• datakey hint was missing for rules edit
• replace “all” alert selection with explicit maximum choices

ipsec

• most safe execution transformations done

isc-dhcp

• move syslog definitions to plugin file
• interalize interfaces_staticarp_configure()
• safeguard access to DHCPv6 “enable” property
• check if device we try to configure exists in the system

kea-dhcp

• add lease commands, tabulator GroupBy, URL hashes
• add DNR option (contributed by schreibubi)
• refactor daemon(8) call to mwexecfb()

network time

status

• refactor to MVC/API
• fix GPS coordinate display in status page (contributed by brotherla)

openvpn

• openvpn: add AES-256-CBC cipher for legacy compat (contributed by Fabian Franz)
• add support for verify-x509-name option (contributed by laozhoubuluo)
• replace exec() in MVC code
• add simple search functionality for accounts table in client export
• skip dynamic content when loading the model in client export
• convert two more exec() calls
• account for CARP status in start and restart cases as well

unbound

• remove delete selected button for single select overrides grid
• add overrides reference counter for aliases
• info section was larger than table width

backend

• minor shell execution changes and readability
• use mwexecf(m) where possible
• extend mwexecfb() with PID and log file support
• exec() removal in get_sysctl()/set_sysctl()
• exec() removal in auth scripts

mvc

• ApiMutableModelControllerBase: add invalidateModel() method
• Config: use is_int()/array_key_first() in toArray() and fromArray()
• Config: mvc: use LIBXML_NOBLANKS when loading config files
• get translated services description from API (contributed by Tobias Degen)
• BaseField: provide asInt() method
• reduce some call overhead in BaseField/IntegerField
• introduce defaultConfig property for AppConfig
• uppercase all form labels
• use asInt() in GidField and UidField
• BaseField: add isSet()
• shield exec_safe() against fatal type errors

rc

• bootstrap /var/lib/php/tests for upcoming test case use

shell

• rewrite timeout() using safe execution functions

tests

• revamped config and base model tests

ui

• refresh notification status after default apply button is done
• remove obsolete jQuery bootgrid files
• bootgrid: allow conditional command rendering through a filter function

plugins

• os-acme-client 4.11
• os-frr 1.50
• os-ndp-proxy-go 1.3
• os-telegraf 1.12.14
• os-theme-rebellion 1.9.4 (contributed by Team Rebellion)
• os-turnserver 1.1
• os-upnp 1.8 features assorted improvements to plugin and daemon (contributed by Self-Hosting-Group)
• os-zabbix-agent 1.18
• os-zabbix-proxy 1.16

src

• divert: define semantics for SO_REUSEPORT_LB on divert sockets
• divert: fix removal of divert sockets from a group
• divert: use a jenkins hash to select the target socket
• divert: use CK_SLISTs for the divcb hash table
• e1000: revert “try auto-negotiation for fixed 100 or 10 configuration”
• in6: modify address prefix lifetimes when updating address lifetimes
• ipv6: do not complain when deleting an address with prefix length of 128
• netlink: do not directly access ifnet members
• netlink: do not overwrite existing data in a linear buffer in snl_writer
• netmap: let memory allocator parameters be settable via loader.conf
• pf: fix handling of IPv6 divert packets
• pf: rationalize the ip_divert_ptr test
• pfsync: avoid zeroing the state export union
• rtsold: check RA lifetime before triggering the one-shot always script
• fix multiple vulnerabilities in OpenSSL
• jail escape by a privileged user via nullfs
• arm64 SVE signal context misalignment
• page fault handler fails to zero memory

ports

• dpinger 3.4
• filterlog no longer uses unneeded promiscuous mode
• libucl 0.9.3
• libxml 2.15.1
• nss 3.119.1
• openssl 3.0.19
• phpseclib 3.0.48
• python security fixes
• suricata 8.0.3

This business release is based on the OPNsense 25.7.8 community version with additional reliability improvements, but without revamped Unbound blocklists for the time being.

Please be aware that during the update check the new package manager will be installed, but will fail to report the update status like it always had before and so you will end up with an error that will require checking for updates again. The fix is in this update, but impossible to install without upgrading the package manager first. We hope this will only be a minor inconvenience during the process.

Also, Python has reported security issues of which a DoS in http.client could potentially affect existing installations given that an HTTP server sends a malicious response which “can consume a large amount of memory and CPU time and cause swapping”. Python has not released an update for version 3.11 at this point in time.

Here are the full patch notes:

system

• use new file_safe() in two instances
• improve the HA VIP sync code
• simplify RRD backup code and remove exec() usage (reported by Alex Williams from Pellera Technologies working with Trend Zero Day Initiative)
• move valid_from search criteria to log_matcher for faster end of search
• use file_safe() in gateway monitor watcher
• refactor factory reset page to MVC and add a reset per component operating on models
• fix a HA sync regression introduced in 25.7.6 that prevented a sync from succeeding in an edge case
• defaults: properly delete empty model containers in the configuration
• switch int/bool to string in gateway properties
• ignore TypeErrors when parsing log lines in the backend
• replace various raw exec(), system(), passthru() and shell_exec() calls with safer variants
• add host route deletion support to system_host_route()
• move the general page host route removal to system_host_route()
• add CA chain to PKCS12 export
• fix hidden syslog HA XMLRPC sync option

interfaces

• fix permission of packet capture file in strict security mode
• ifctl: always allow reads to internal state files
• fix overview details button not working
• support link-local IPv6 mode
• also stop PPPoE connections when CARP is temporarily disabled (contributed by René Mayrhofer)
• fix packet capture and ping buttons not working since 25.7.7
• limit execution of sysctl scope in PPP device edit code
• safer interfaces_pfsync_configure() handling

firewall

• refactor live log using a ring buffer
• add toggles to disable selected automatic rules
• enable “safe delete” for categories
• improved stats rendering on automation rules
• allow searching aliases in automation rules inspect mode by IP address
• automation: fix alias IP address search
• automation: allow interface parameter to contain a list of interfaces for API users
• aliases: replace invalid unicode chars (contributed by Marius Halden)
• live log: only execute redraw on visibility state transition
• live log: optimize viewbuffer rendering
• live log: prevent re-resolving in-flight requests and move host lookup to current filtered view
• live log: restructure DOM layout to reduce wasted header space
• live log: fix wrong variable scope
• live log: revert static property, persistence is disabled for this grid
• states: fix delete_selected firewall states (contributed by Alexander Sulfrian)
• do not allow nesting in GeoIP aliases
• automation: split search logic and normalize legacy output
• aliases: add a few GeoIP related logging messages
• mute pfctl-based table entry expire to avoid cron noise due to stderr use
• aliases: missing placeholder for username in basic auth type selection
• support “0” as valid rule ID in rule lookup redirect
• automation: add per-rule state timeouts for “udp.first”, “udp.multiple” and “udp.single”

captive portal

• fix selectpicker #voucher-groups not being re-rendered after change event
• move grid init to tab show event

dnsmasq

• strict hostname and domain validation plus improved ipset validations
• add optgroup support to DHCP option fields and expose all DHCPv4 options
• switch to file_safe() use in backend
• minor safe execution changes in backend

firmware

• package manager upgrade changes for pkg 2.x

intrusion detection

• remove obsolete “ac-bs” pattern matcher algorithm

ipsec

• sessions: add datakey property for row mapping
• status: search phase 2 triggered twice on click and cleanup tooltip event as well
• disable model caching on SPD page
• add AES256GCM16 to the child ESP proposals list
• hide phase 2 output based on phase 1 status instead of the row count for phase 2
• add “reqid_base” setting to advanced settings
• sessions: fix missing commands translation
• connections: prevent model caching when referring items within the same model

isc-dhcp

• adjust backend for safe execution

kea-dhcp

• automatic route support for PD leases
• case insensitive MAC address comparison

openssh

• minor safe execution change in backend

openvpn

• add support for pushing excluded routes via net_gateway (contributed by Patrice Damezin)
• allow multiple domains settings for client connection (contributed by Krisztian Ivancso)
• use file_safe() to write CRL files
• swap description and mode in “tls_key” and require a description for static keys
• one safe execution change
• add fast-io option (contributed by mdten)

radvd

• safe execution changes

unbound

• use file_safe() for root hint creation
• deprecate unmaintained AdAway blocklist (contributed by Maurice Walker)
• duplicate pointer records due to not casting the field types
• missing lock in del_host_override action

wireguard

• add debug option to instances
• fix wrong maximum value for “PersistentKeepalive”

backend

• add file_safe() helper for atomic file creation
• rename “realif” variables to “device” in a number of spots
• avoid the use of get_real_interface() when it does not matter and remove dead code associated with that
• exend shell_safe() to emulate exec() $output argument magic
• reimplement existing command execution functions with Shell class implementation
• replace mwexecf_bg() with mwexecfb() for clarity

mvc

• add RegexField to properly validate PCRE2 syntax
• support arrays in search clauses
• OptionField: properly translate optgroup
• JsonKeyValueStoreField: fix race condition when using SourceField in the model
• persist models description in root attribute of its respective configuration
• tweaked model definitions, especially descriptions and validation message style
• slightly adjust two getOption() calls in constraints
• BaseListField: always map values in getDescription()
• BaseListField: account for option container and passthrough value
• remove getCurrentValue() compatibility wrapper
• Backend: always return strings in configdRun() and configdpRun()
• improve replaceInputWithSelector() to support an empty placeholder
• setDefault() not fired as setValue() was set with an empty string
• allow empty responses to fix a regression due to stream output safety path addition
• remove empty string fallbacks for backend invokes that are no longer needed
• more style changes on existing core models
• disable Dnsmasq/Unbound template generation
• remove getDescription() overlay in ModelRelationField
• protect JSON response against UFT-8 encoding failures
• HTML-decode select element values

rc

• make changes to php,var,tmp bootstrap

ui

• switch from Bootgrid to Tabulator for MVC grid rendering
• numerous switches to shared base_bootgrid_table and base_apply_button use
• flatten nested containers for grid inclusion
• use snake_case for all API URLs and adjust ACLs accordingly
• move tooltip load event to single-fire mode
• add checkmark to SimpleActionButton as additional indicator
• improve menu icons/text spacing (contributed by Konstantinos Spartalis)
• bootgrid: clean up leftover compatibility bits
• bootgrid: add missing sortable option
• bootgrid: provide more styling possibilities from formatters
• fix language selection for low vertical resolution screens (contributed by Konstantinos Spartalis)
• hide header of the picture widget on the dashboard (contributed by Konstantinos Spartalis)
• bootgrid: add tabulatorOptions to translateCompatOptions()
• bootgrid: raise rowCount default to 50 and adjust selections accordingly for most pages
• bootgrid: simplify custom grid command additions
• do not add an empty option into an empty option group
• add datetime-local to field types

plugins

• replace variables in package scripts by default
• os-OPNBEcore 1.6 with OpenID Connect and scheduled jobs support
• os-OPNWAF 2.0 with OpenID Connect support, customizable error documents and updated rule set
• os-acme-client 4.10
• os-bind 1.34
• os-c-icap 1.9
• os-caddy 2.0.4
• os-clamav 1.8.1
• os-crowdsec 1.0.12
• os-dnscrypt-proxy 1.16
• os-etpro-telemetry 1.8 now shows more status responses in widget
• os-frr 1.47
• os-gdrive-backup 1.0 for Google Drive backup support
• os-grid_example 1.1 updates best practice on grid development
• os-netbird 1.0 (contributed by Gauss23 and Bethuel Mmbaga)
• os-netbird 1.1 fixes service startup and switches to syslog (contributed by Bethuel Mmbaga)
• os-nginx 1.35
• os-openvpn-legacy 1.0 for legacy OpenVPN components support
• os-puppet-agent 1.2
• os-shadowsocks 1.3
• os-smart 2.4 adds extended info option (contributed by poisonbl)
• os-squid 1.3
• os-strongswan-legacy 1.0 for legacy IPsec components support
• os-telegraf 1.12.13
• os-theme-advanced 1.1 (contributed by Jaka Prašnikar and Raushan Patel)
• os-theme-cicada 1.40 (contributed by Team Rebellion)
• os-theme-tukan 1.30 (contributed by Team Rebellion)
• os-theme-vicuna 1.50 (contributed by Team Rebellion)
• os-zabbix-agent 1.17
• os-zabbix-proxy 1.14

src

• FreeBSD 14.3-RELEASE-p4 plus assorted stable/14 networking commits
• add a new sysctl in order to differentiate UEFI architectures
• libarchive: merge version 3.8.1
• lagg: fix if_hw_tsomax_update() not being called
• wg: add support for removing allowed-ip entries and assorted cleanups
• ovpn: support multihomed server configurations and assorted cleanups
• netlink: fully clear parser state between messages
• udp: fix a inpcb refcount leak in the tunnel receive path
• p9fs: assorted fixes
• assorted network stack fixes via stable/14
• if_ovpn: support IPv6 link-local addresses
• if_ovpn: support floating clients
• if_ovpn: fill out sin_len/sin6_len
• if_ovpn: destroy cloned interfaces via a prison removal callback
• ifconfig: support VLAN ID in static/deladdr
• bnxt: fix the request length in bnxt_hwrm_func_backing_store_cfg()
• iflib: set the get counter routine prior to attaching the interface
• ifnet: defer detaching address family dependent data
• ixgbe: fix incomplete speed coverage in link status logging
• ixl: fix queue MSI and legacy IRQ rearming
• openssl: fix multiple vulnerabilities
• re: add PNP info for module
• re: make sure re_rxeof() is called in net epoch context
• vfs: fix copy_file_range() failing to set output parameters

ports

• curl 8.16.0
• dnspython 2.8.0
• expat 2.7.3
• kea 3.0.2
• libxml 2.14.6
• nss 3.118.1
• openssh 10.2p1
• openvpn 2.6.17
• pcre2 10.47
• php 8.3.28
• pkg 2.3.1
• python 3.11.14
• sqlite 3.50.4
• strongswan 6.0.3
• suricata 8.0.2
• syslog-ng 4.10.2
• unbound 1.24.2

The OPNsense business edition transitions to this 25.10 release including revamped frontend grid UI, experimental privilege separation for the GUI, a new and improved firewall automation GUI, performance enhancements especially for numerous aliases being used at once, OpenID Connect integration, captive portal backend rewrite, Greek as a new language, FreeBSD 14.3 plus much more.

Please make sure to read the migration notes before upgrading.

Download link is as follows. An installation guide and the checksums for the images can be found below as well.

This business release is based on the OPNsense 25.7.5 community version with additional reliability improvements.

Here are the full patch notes:

• system: the setup wizard was rewritten using MVC/API
• system: change default DHCP use from ISC to Dnsmasq for factory reset and console port and address assignments
• system: numerous permission, ownership and directory alignments for web GUI privilege separation
• system: allow experimental feature to run web GUI privilege separated as “wwwonly” user
• system: add a banner when trying to revert the privilege separated GUI back to root at run time
• system: consistently use empty() checks on “blockbogons”, “blockpriv”, “dnsallowoverride” and “dnsallowoverride_exclude”
• system: change default system domain to “internal” (contributed by Self-Hosting-Group)
• system: remove the “optional” notion of tunables known to the system
• system: enable kernel timestamps by default
• system: allow CSR to be downloaded from System/Trust/Certificates (contributed by Gavin Chappell)
• system: HTML decode entities when generating new QR code for user
• system: add missing timestamp formatter in snapshots
• system: prevent misconfigurations with the automatic user creation option
• system: add pluginctl hook for cache_flush
• system: rewrite wwwonly bootstrap procedure
• system: allow authentication events from wwwonly user
• system: fix two regressions due to stream output path safety addition
• system: fix reconfigure control on HA status page for small viewports
• system: add pluginctl -m and -v options for model migrations and validations calls
• system: add “power off” backend action to GUI cron options
• system: add the pfsync “defer” option to high availability
• system: return both interfaces in a single call for get_nameservers()
• system: safeguard legacy local_sync_accounts() against malformed user entries
• system: change atrun interval to every minute
• reporting: removed the unused second argument in getSystemHealthAction()
• reporting: renamed getRRDlistAction() to getRrdListAction()
• reporting: fixed internal parameter names in insight graphs
• interfaces: fix media settings write issue since 24.7 as it would not apply when “autoselect” result already matched
• interfaces: removed defunct SLAAC tracking functionality (SLAAC on WAN still works fine)
• interfaces: no longer fix improper WLAN clone naming at run time as it should be ensured by code for a long time now
• interfaces: remove the functions get_configured_carp_interface_list() and get_configured_ip_aliases_list()
• interfaces: add VIP grid formatter to hide row field content based on the set mode
• interfaces: drop redundant updates in rtsold_resolvconf.sh (contributed by Andrew Baumann)
• interfaces: moved get_real_interface() to util.inc
• interfaces: replace MAC vendor database from py-netaddr with a simple local implementation
• interfaces: refactor getting both devices from interface in settings page
• interfaces: get both devices of interface in one call
• interfaces: fix flags display in interface overview detail
• firewall: add expire option to external aliases to automatically cleanup tables via cron
• firewall: removed the expiretable binary use in favour of the builtin pfctl
• firewall: speed up alias functionality by using the new model caching
• firewall: consolidated ipfw/dnctl scripting and fix edge case reloads
• firewall: code cleanup and performance improvements for alias diagnostics page
• firewall: assorted UI updates for automation pages
• firewall: a few minor improvements in automation GUI
• firewall: remove unused “set loginterface” clause
• firewall: additional statistics for alias grid
• firewall: fix shaper reset button
• firewall: add “quick” mode in alias update to skip table size comparison during schedules
• firewall: adjust firewall_rule_lookup to open correct interface and rule from firewall live log
• firewall: add port alias selection to source_port and destination_port
• firewall: implement alias description tooltip and other UX tweaks
• firewall: add optional Tabulator tree view to show categories as rule folders in automation
• firewall: put sequence and sort_order in advanced mode of automation rules
• firewall: front-end table rendering performance improvement for alias diagnostics
• firewall: also set groups for special IPv6 interfaces
• firewall: ignore empty lines for pf table counting
• firewall: support tags in source NAT automation rules
• firewall: treat “skip” protocol as a string to avoid syntax error
• firewall: improve alias parsing performance in diagnostics page
• firewall: support IPinfo format for GeoIP
• firewall: adapt default table size calculation
• firewall: fix flags not showing on GeoIP selection
• captive portal: migrate backend from IPFW to PF
• captive portal: fix regression when NAT reflection is enabled
• captive portal: fix command line argument parsing in backend
• captive portal: remove obsolete interfaces_inbound option that works by default now
• captive portal: missing fix for command line argument parsing in backend
• captive portal: fix display issue for pass rule when client not in zone
• captive portal: allow disabling automatic firewall rules
• captive portal: exclude portal table in destination
• captive portal: restore the logging of drop reasons
• captive portal: fix last_accessed being cached from previous entries if N/A
• captive portal: mark alias as type external for use in rules
• captive portal: align accounting session timeout with API
• captive portal: API dispatcher is now privilege separated via “wwwonly” user and group
• captive portal: preparations for SSO identification support
• captive portal: move backend scripts directory
• captive portal: various style cleanups
• captive portal: restyle default login template
• captive portal: case insensitive MAC parsing
• captive portal: remove stale dir-listing.activate from web server
• captive portal: support OpenID Connect authentication through custom template
• dnsmasq: add optional subnet mask to “dhcp-range” to satisfy DHCP relay requirements
• dnsmasq: sync CSV export with ISC and Kea structure
• dnsmasq: add CNAME configuration option to host overrides
• dnsmasq: add ipset support
• dnsmasq: swap hosts and domains tab for consistency reasons
• dnsmasq: allow disabling local for DHCP domains
• dnsmasq: add Tabulator “groupBy” functionality to group by interfaces
• dnsmasq: add leases widget that shows latest leases
• dnsmasq: refine the selection of automatic DHCP rules for eligible interfaces
• firmware: opnsense-version: build time package variable replacements can now be read at run time
• firmware: hide community plugins by default and add a checkbox to unhide them on the same page
• firmware: introduce a new support tier 4 for development and otherwise unknown plugins
• firmware: disable the FreeBSD-kmods repository by default
• firmware: opnsense-version: support more elaborate -R replacement
• firmware: store update and upgrade logs in edge cases
• firmware: opnsense-version: support file based -R option
• firmware: opnsense-update: support -g for update log view
• firmware: remove tier 2 workaround for Zenarmor plugins
• firmware: add date to modal header
• firmware: opnsense-patch: fix cache flush using new hook
• firmware: add vuxml.freebsd.org to CRL handling hostnames
• firmware: switch business mirror layout
• intrusion detection: add JA4 support (contributed by Maxime Thiebaut)
• intrusion detection: fix interface name conversion
• intrusion detection: fix ja4 option templating
• intrusion detection: fix and simplify grid search in download tab
• intrusion detection: fix downloads tab not loading with Tabulator
• intrusion detection: revert “fix downloads tab not loading with Tabulator”
• intrusion detection: make grids virtual to fix performance issues
• ipsec: fix regression in configuration write with introduced volatile fields
• ipsec: add firewall rules skip option for VTIs
• ipsec: deprecate legacy stroke and implement swanctl for overview
• ipsec: add default value to “make_before_break” that retains disabled default
• ipsec: fix bulk operations in SPD page
• ipsec: dots are not allowed in pool names
• ipsec: allow underscores in PSK identifiers
• isc-dhcp: show tracking IPv6 interfaces when automatically enabled and offer an explicit disable
• isc-dhcp: hide IPv4 menu items when Dnsmasq DHCP is enabled to improve out of the box experience
• isc-dhcp: add static mapping CSV export
• isc-dhcp: allow static mapping export for disabled entries
• kea-dhcp: honour IPv4 client specific reservation domain name option (contributed by NOYB)
• kea-dhcp: expose lease expiration settings to the GUI (contributed by Konstantinos Spartalis)
• kea-dhcp: support DHCP option 121 (classless static routes)
• lang: add Greek as a new language (contributed by Konstantinos Spartalis)
• lang: make more strings translate-able (contributed by Tobias Degen)
• lang: updates for Chinese, Czech, German and Greek
• lang: new Ukrainian language and assorted updates
• monit: move backend scripts directory
• monit: fix migration weirdness with run/post use
• openvpn: the server wizard functionality has been permanently removed as it required the old wizard implementation
• radvd: refine checks that ignored 6rd and 6to4
• wireguard: move backend scripts to proper location
• unbound: fix error in edge case of initial model migration
• unbound: configurable top domain list length in reporting view (contributed by Konstantinos Spartalis)
• unbound: remove unknown model reference and protect/simplify remaining one
• unbound: add support for TXT records in host overrides
• backend: trigger boot template reload without using configd
• backend: added IPv6 bracket helper for templates (contributed by BPplays)
• backend: add “!” operator to execute and flush cache when it exists
• mvc: introduce generic model caching to improve operational performance
• mvc: field types quality of life improvements with new getValues() and isEqual() functions
• mvc: filed types deprecated getCurrentValue() in favour of getValue() and removed isEmptyString()
• mvc: new BaseSetField() as a parent class for several other field types and numerous new and improved unit tests
• mvc: support chown/chgrp in File and FileObject classes
• mvc: use getNodeContent() to gather grid data
• mvc: allow PortOptional=Y for IPPortField
• mvc: remove SelectOptions support for CSVListField
• mvc: migrated use of setInternalIsVirtual() to volatile field types
• mvc: fix getDescription() in NetworkAliasField
• mvc: improve resilience of VPNIdField and LinkAddressField
• mvc: repair side affect of getDescription() change causing performance regressions
• mvc: modify existing and add missing descriptions in models
• mvc: set default validation message for CertificateField
• mvc: BaseModel: minor non-functional cleanups
• mvc: ModelRelationField: keep array structure in memory to avoid reinitiating object construction
• mvc: tweaked model definitions, especially descriptions and validation message style
• mvc: slightly adjust two getOption() calls in constraints
• mvc: BaseListField: always map values in getDescription()
• mvc: BaseListField: account for option container and passthrough value
• mvc: remove getCurrentValue() compatibility wrapper
• mvc: Backend: always return strings in configdRun() and configdpRun()
• mvc: improve replaceInputWithSelector() to support an empty placeholder
• mvc: setDefault() not fired as setValue() was set with an empty string
• mvc: allow empty responses to fix a regression due to stream output safety path addition
• mvc: remove empty string fallbacks for backend invokes that are no longer needed
• mvc: more style changes on existing core models
• mvc: disable Dnsmasq/Unbound template generation
• mvc: remove getDescription() overlay in ModelRelationField
• mvc: protect JSON response against UFT-8 encoding failures
• mvc: HTML-decode select element values
• rc: make changes to php,var,tmp bootstrap
• ui: switch from Bootgrid to Tabulator for MVC grid rendering
• ui: numerous switches to shared base_bootgrid_table and base_apply_button use
• ui: flatten nested containers for grid inclusion
• ui: use snake_case for all API URLs and adjust ACLs accordingly
• ui: move tooltip load event to single-fire mode
• ui: add checkmark to SimpleActionButton as additional indicator
• ui: improve menu icons/text spacing (contributed by Konstantinos Spartalis)
• ui: bootgrid: clean up leftover compatibility bits
• ui: bootgrid: add missing sortable option
• ui: bootgrid: provide more styling possibilities from formatters
• ui: fix language selection for low vertical resolution screens (contributed by Konstantinos Spartalis)
• ui: hide header of the picture widget on the dashboard (contributed by Konstantinos Spartalis)
• ui: bootgrid: add tabulatorOptions to translateCompatOptions()
• ui: bootgrid: raise rowCount default to 50 and adjust selections accordingly for most pages
• ui: bootgrid: simplify custom grid command additions
• ui: do not add an empty option into an empty option group
• ui: add datetime-local to field types
• plugins: replace variables in package scripts by default
• plugins: os-OPNBEcore 1.7
• plugins: os-OPNcentral 1.12
• plugins: os-q-feeds-connector 1.2
• plugins: os-squid 1.4 works around CVE-2025-62168 (contributed by m.a.x. it)

Migration notes, known issues and limitations:

• The captive portal implementation moves from IPFW to PF. Check the technical details first, especially regarding the new ruleset behaviours.
• Deprecated Google Drive backups due to upstream policy changes and moved to plugins for existing users.
• API URLs registered in the default ACLs have been switched from “camelCase” to “snake_case”.
• API grid return values now offer “%field” for a value description when available. “field” will now always be the literal value from the configuration. The API previously returned a display value for some field types, but not all.
• Reverted tunables “hw.ibrs_disable” and “vm.pmap.pti” to FreeBSD defaults when no explicit values have been set in tunables.
• Moved OpenVPN legacy to plugins as a first step to deprecation.
• Moved IPsec legacy to plugins as a first step to deprecation.

The public key for the 25.10 series is:

# -----BEGIN PUBLIC KEY-----
# MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAn9lXekbm5KcktbiWpmQf
# drRC8LmAOTV9Cbdd3em6iDFFcw8vmRS7Rbo2/exxYiPCqEPxxPtUsW+g/a6fqPJp
# pof5D1EHWqzPfkjRQV6ipQjm+ocJGkfbeHsp5I77L+w7om5TbPYBkOjg+iMd442d
# VYxgqXmMZy+6v78ofVM+wyba0GkRymFt0qf5k5uk3Auztcfanc2Ymsc+PDdjGHQd
# c9H8T0T6To8Z0xrbEXzY00IqSRkLto9Cl+xEmEAz/AiEu2WtEadOqSpDy9dsJfQg
# HpBQVlGQdphj5zmkqG6JSL1Uw+02OeIXOfFWRtqgW7vMyU0IbER3hLpvh6BlsqNJ
# LCPfD7F/dzDPU5LniDRRb4MrTlVpJk2h8pk7GbmJCqAyWJJZ6n3a+InPtUfl9gP5
# T0d15N7myh8RLssP+TIy8hiBHtc/yK89dUahGei1xDuh0HdytRLLLWVXqgWwgXhd
# 9it8l8AJ/D2BtuyExpJOWx3sYvmhJiPN8phCaR2G2E+QRA2X5nHGyUw5jYpKI8Om
# Q2khz1PBYcA/T5lKhM3HRFCu2HZsPKT5CEevZfUuPDXIqwx+LMFs6qqbzbGrdn1F
# H6ZSlG0BWuokeyjhN2mB0Fr6kdLobmfVgZHUS7KOwcI9BdftSDbEk8kMxrQlwugh
# 4I1hTrAycMERbjeUKg1plx8CAwEAAQ==
# -----END PUBLIC KEY-----

SHA256 (OPNsense-business-25.10-dvd-amd64.iso.bz2) = 6c45cd311960d42aa87933d2134c19825565d1ab74caa4129d08a938dbf621e8

SHA256 (OPNsense-business-25.10-nano-amd64.img.bz2) = 2a706e56c45a1ecc8d4f14f85d3e07f1f3be85ac2d79459f62e9fed860edae19

SHA256 (OPNsense-business-25.10-serial-amd64.img.bz2) = 8e8460dc8751cb0c7ab863d44ceb59a59a3eadbb9622ac707e43aeda002a3d7e

SHA256 (OPNsense-business-25.10-vga-amd64.img.bz2) = fefac8e50c30c463072fbda508c675d176a0f0a7d910eacede3112e7a76dc365

This business release is based on the OPNsense 25.4.2 business version with additional reliability improvements and adds Dnsmasq DHCP support.

A new US-based business mirror has been added. To accommodate upcoming certificate renewals our behaviour of libfetch CRL checking was slightly changed to omit a missing CRL warning on leaf certificates that certificate vendors do not typically offer in the first place. When certificates are going to be replaced on the business mirrors in October due to pending renewal all versions prior to 25.4.3 will print the spurious warning that no CRL was provided for the leaf certificate but CRL checking will still be carried out as usual and the warning will still be printed when a signing CA certificate does not publicly provide its CRL to check against.

Here are the full patch notes:

• system: increase log file download timeout to prevent exit before data has returned
• system: prevent misconfigurations with the “Automatic user creation” authentication option
• system: prevent the root user from changing its name
• interfaces: capture netmap ring when listening on interfaces in netmap mode
• dnsmasq: add full DHCP/RA support
• firmware: abort on what appear to be partial updates due to obscure file errors
• firmware: add US east coast mirror for business edition
• ipsec: passthrough networks setting missed “allow new” flag
• kea-dhcp: ignore encoding errors in lease parser
• src: libfetch: ignore leaf certificates missing CRL which in practice is not offered by most authorities
• src: libarchive: update to 3.8.1 to fix integer overflow leading to double free
• src: route: fix “route -n monitor” when its output is redirected

A hotfix release was issued as 25.4.3_4:

• system: properly check request type on HA status page in restartAllAction() (reported by Stanislav Fort of Aisle Research)
• firmware: add fingerprint, migration notes and upgrade hint for 25.10
• mvc: stream output not properly cleansed when used in widget (reported by Stanislav Fort of Aisle Research)
• ui: legacy_html_escape_form_data() was not escaping keys only data elements (reported by Alex Williams from Pellera Technologies)

This business release is based on the OPNsense 25.1.12 community version with additional reliability improvements, but without Dnsmasq DHCP support and without the captive portal backend switch.

Here are the full patch notes:

system

• safeguard local_group_set() since users may not exist for valid reasons
• fix regression in setGroupMembership()
• add “Source Networks” option to groups to restrict connectivity to web GUI
• remove defunct “sshlogingroup” OpenSSH option because non-admins are no longer permitted shell access
• reduce font size in thermal sensors widget tooltip (contributed by indeed-a-genius)
• allow access to cached watcher gateway status
• implement “force_down” failover support
• implement base_bootgrid_table in user, group and priv templates
• balance fastcgi servers a bit better
• check private key matches provided certificate data
• introduce a “wwwonly” user and group and related privilege separation preparations
• add minimalistic interface to support SSO authentication
• refactor a couple of existing empty() tests to isEmpty()
• refactor cache flush into system_cache_flush()
• add backend call for returning timezones
• fix “weight” default fallback causing non-string return in gateway status
• fix route status removal buttons
• fix passing “arguments” as parameters for cron jobs
• add banner to HA sync and firmware page when proxy environment override is used
• fix audit message strings
• add missing “kernel” application for remote logging

interfaces

• emulate device name return in ifconfig edge case for legacy_interface_create()
• cleanup spurious functions regarding VIP access
• consider tracked interfaces linked devices on reload
• convert bridge configuration to MVC/API
• remove unused is_interface_assigned()
• refactor newwanip IPv4/v6 scripts to reduce differences between them
• do not call a description a “dmesg”
• relax regex for dmesg probing to seamlessly support dmesg timestamps
• remove unused “friendly” value from get_interface_list()
• add update mode to ifctl
• attempt to work around mangled MPD label

firewall

• add ability to specify IPv6 pipe and queue masking using the src-ip6/dst-ipv6 specifiers (contributed by Daniel Tang)
• use shared base_bootgrid_table and base_apply_button in shaper
• use CIDR notation for specifying masks to dnctl (contributed by Daniel Tang)
• improve dummynet_stats.py parsing of mask descriptor lines (contributed by Daniel Tang)
• exclude interfaces with local links only when generating force gateway rules
• fix missing lock while refactoring config for group changes
• properly synchronize load order for shaper when reloading configuration
• add toggle log command in automation
• tighten address / range validation for aliases
• align alias tokenizer options with the ones in our base template
• improve address family validation for rule source and destination
• fix faulty ICMP type evaluation on NAT rules
• skip reply-to for inversion rules
• fix AttributeError: DNAME object has no attribute address on DNS fetch for aliases

captive portal

• balance fastcgi servers a bit better
• do not share a fastcgi socket with web GUI

dnsmasq

• allow AliasesField values to be cleared
• allow host wildcards in domain overrides again
• fix DomainIPField to allow IP address to be emptied

firmware

• upgrade scripts for automatic GDrive, IPsec and OpenVPN legacy plugin installation
• remove unbound/duckdb migration script

intrusion detection

• add an override banner for custom.yaml use

ipsec

• fix ipsec column identifier
• add “cacert” option in remote auth section and allow spaces and wildcards in id fields
• be more verbose when modifying SPDs
• add aes256-sha1 ESP proposal

kea-dhcp

• fix parsing both address families in static mappings
• add advanced options (pd-)allocator in DHCPv6
• add static_routes validation (contributed by Dr. Uwe Meyer-Gruhl)
• fix fatal socket path refusal in new Kea release
• add DNS field to Kea DHCP4 reservations (contributed by Gtt1229)

openvpn

• add port-share as advanced feature
• add (push) block-ipv6 option
• remove deprecated use of is_interface_assigned() in legacy client/server
• validate group membership after authentication
• add nopool directive
• let server/server_ipv6 require a netmask
• “keepalive_timeout” must be at least twice the interval value validation

unbound

• remove “inplace” in chained assignment (contributed by dstapa)
• improve the chroot mounting code to avoid excessive (un)mount calls
• ignore TXT records for wildcard host entries

wireguard

• add diagnostics and log file ACL

backend

• use the new errors:no instead of “exit 0” in actions

lang

• update language translations to their latest state
• further updates

mvc

• add contribDir to app config (contributed by Freddie Sackur)
• show versions on migration failure for clarity
• deny whitespaces, asterisks and slashes in HostnameField
• support array response type in session->get()
• eventually phase out getCurrentValue() in favour of getValue()

ui

• backwards-compatible merge of Tabulator grid replacement changes
• replace self-closing select element (contributed by Gavin Chappell)
• add standard HTML color input support

plugins

• os-OPMWAF 1.9
• os-beats 1.0 (contributed by Maxime Thiebaut)
• os-c-icap 1.8
• os-caddy 2.0.2
• os-crowdsec 1.0.10
• os-haproxy 4.6
• os-postfix 1.24
• os-radsecproxy 1.1
• os-stunnel 1.0.6 adds LDAP and NNTP to supported STARTTLS protocols (contributed by Patrick M. Hausen)
• os-sunnyvalley 1.5 switches mirror domain
• os-zabbix-agent 1.16
• os-zabbix-proxy 1.13

src

• pf: explicitly NULL state key pointers
• pf: fix panic in pf_return()
• pf: do not use state keys after pf_state_insert()
• netlink, socket, sctp, tcp, udp: assorted upstream stable changes
• in6_control_ioctl: correctly report errors from SIOCAIFADDR_IN6
• axgbe: add support for Yellow Carp Ethernet device
• dhclient: keep two clocks
• rtw88, rtw89: merge Realtek driver based on Linux v6.14
• iwlwififw: remove Intel iwlwifi firmware from src.git
• ifconfig: optimise non-listing case with netlink
• xz: fix use-after-free in multi-threaded xz decoder
• ena: fix misconfiguration when requesting regular LLQ
• zfs: fix corruption in ZFS replication streams from encrypted datasets
• libc: allow __cxa_atexit handlers to be added during __cxa_finalize

ports

• curl 8.14.1
• dhcp6c 20250513 fixes spawning multiple instances
• kea 2.6.3
• libxml 2.14.5
• nss 3.113.1
• openldap 2.6.10
• openssl 3.0.17
• perl 5.40.2
• pftop 0.13
• php 8.3.23
• phpseclib 3.0.46
• py-duckdb 1.3.1
• python 3.11.13
• sqlite 3.50.2
• sudo 1.9.17p1
• suricata 7.0.11
• unbound 1.23.1

This business release is based on the OPNsense 25.1.6 community version with additional reliability improvements, but without Dnsmasq DHCP support and the recent captive portal backend switch.

Here are the full patch notes:

system

• extend XMLRPC “nosync” support to keep backup items for new cases
• use RADIUS Message Authenticator by default
• prevent recursion loop when CAs are cross-referencing each other
• fix off by one error due to line ending at the end of a log file
• offer config directory to store locations for external certificates and support it in the certificates widget
• allow multiple manual DNS search domains
• fix gateway watcher backoff
• minor code cleanups in auth.inc
• kill gateways states for failback scenario when a higher priority gateway goes back online
• update to latest tzdata content for time zones and ISO 3166 definitions
• clean up a number of unused functions
• refactor a VIP access in auth.inc
• add field “boottime” to api/system/systemTime (contributed by eopo)

reporting

• move NetFlow backend single_pass to command line parameters for easier debugging
• use client time in traffic dashboard widget
• replace insights totals chart with ChartJS variant
• minor style fixes and cleanups in health graphs

interfaces

• refactor bridge configuration backend
• refactor wireless device assignment
• allow literal comma by escape sequence in DHCP advanced option modifiers
• fix refresh button in ARP page
• fix “(de)select all” button in packet capture
• rename ip_in_subnet() to reflect it is only for IPv4
• remove unused get_vip_descr()

dnsmasq

• domain to host migration for hosts

firewall

• automation filter UI revamp
• fix regression in alias table in JSON format
• replace update_params for argparse in filter log reader
• prevent source/destination inversion when multiple nets are selected
• support comma separated alias targets in refactor() call
• added multi-select for ICMP type
• update user agent in alias URL fetch

firmware

• ignore dashboard check for updates link automation if user clicks check for updates too
• fix reboot flag handling due to changed BooleanField default in 25.1.4
• add cleanup audit script

intrusion detection

• fix a log reader regression in the alert view
• fix alert info button

ipsec

• move mobile clients charon attributes to “Advanced settings”
• fix auth server parsing regression
• copy “Split DNS name” to undocumented “25” option
• fix more ACLs related to individual IPsec page use
• add DH Group 2 for basic Azure VPN gateway compatibility
• fix trimming NULL values
• attr 28673 previously rendered as 1 instead of strongswan default “yes”/“no” for a boolean

isc-dhcp

• use “lease_type” to key lease map in addition to “iaid_duid” (contributed by Alex Goodkind)
• fix invalid FQDN generation from DHCPv4 static map domains (contributed by Steven Zimmermann)

kea-dhcp

• allow manual configuration for advanced scenarios
• add DHCPv6 support
• split into multiple id-based services
• fix menu for overlapping leases links
• correct static mapping returns for IPv6 addresses
• translate reservation MAC address when dash is used

openvpn

• display virtual IPv6 addresses for clients in dashboard widget (contributed by cs-1 and lucaspalomodevelop)
• simplify the VIP handling in legacy pages

router advertisements

• fix list of source addresses on overlapping link-locals (contributed by Robin Müller)

unbound

• add optional TTL field

backend

• support “errors:no” clause on actions

mvc

• prefer ui/user_portal above system_usermanager_passwordmg.php in ACLs
• implement “ignore” field type in forms
• allow referencing disabled interfaces in LinkAddressField
• fix scoping issue in CertificatesField
• BooleanField now defaults to “0” on creation
• add static $internalStaticChildren in classes extending ArrayField
• safeguard JsonKeyValueStoreField->setSourceField()

ui

• include “all” instead of only “solid” and “brands” Font Awesome styles
• ensure fields stay aligned relatively to another when headers are used in forms
• add fetch_options() which can build grouped selectpickers
• improve and extend Bootgrid behaviour

plugins

• os-caddy 1.8.5
• os-ndproxy 1.1
• os-sftp-backup 1.1 adds hostname prefix and filedrop-only support (contributed by beposec)
• os-theme-rebellion 1.9.3 (contributed by Team Rebellion)
• os-turnserver 1.0 (contributed by Frank Wall)
• plugnis: os-squid 1.2

src

• ifconfig: fix reporting optics on most 100g interfaces
• igc: fix attach for I226-K and LMVP devices
• inpcb: assorted changes for upcoming FIB support
• ipfw: fix dump_soptcodes() handler
• ixgbe: add support for 1000BASE-BX SFP modules
• ixgbe: fix mailbox ack handling
• netinet6: add the missing lock acquire to nd6_get_llentry
• netinet: fix getcred sysctl handlers to do nothing if no input is given
• netinet: if mb_unmapped_to_ext() failed, return directly
• netlink: fix getting route scope of interface IPv4 addresses
• ovpn: fix use-after-free of mbuf
• pf: improve pf_state_key_attach() error handling
• pfkey2: use correct value for a key length
• routing: do not allow PINNED routes to be overridden
• sctp: fix double unlock in case adding a remote address fails
• tcp: clear sendfile logging struct
• udp: do not recursively enter net epoch
• wg: remove overly-restrictive address family check
• caroot: update the root bundle
• openssl: import OpenSSL 3.0.16
• daemon: stop rebuilding the kqueue every restart of the child
• contrib/expat: update libexpat from 2.6.0 to 2.7.1
• contrib/tzdata: import tzdata 2025b
• pfctl: fix faulty rule anchor counter print
• pfctl: fix recursive printing of NAT rules
• pf: Use a macro to get the hash row in pf_find_state_byid()
• netinet6: work around synchronization issue in dying netgraph device
• wg: Improve wg_peer_alloc() to simplify the calling
• bnxt_en: Retrieve maximum of 128 APP TLVs
• Revert “amd64 GENERIC: Switch uart hints from isa to acpi”

ports

• curl 8.13.0
• expat 2.7.1
• kea 2.6.2
• lighttpd 1.4.79
• monit 5.35.2
• nss 3.110
• openssh 10.0p1
• phalcon 5.9.3
• php 8.3.20
• py-duckdb 1.2.2
• python 3.11.12
• syslog-ng 4.8.2
• unbound 1.23.0

The OPNsense business edition transitions to this 25.4 release including numerous MVC/API conversions, a new user self-service portal, user CSV import/export, improved security zones support and documentation, a new UI look with a light and dark theme, PHP 8.3, FreeBSD 14.2 plus much more.

Please make sure to read the migration notes before upgrading.

Download link is as follows. An installation guide and the checksums for the images can be found below as well.

This business release is based on the OPNsense 25.1.4 community version with additional reliability improvements.

Here are the full patch notes:

• system: migrate user, group and privilege management to MVC/API
• system: remove the “disable integrated authentication” feature
• system: add “Default groups” option to add standard groups when a LDAP/RADIUS user logs in
• system: remove the old manual LDAP importer
• system: migrate HA status page to MVC/API
• system: allow custom additions to sshd_config (contributed by Neil Greatorex)
• system: increase max-request-field-size for web GUI
• system: set tunable default for checksum offloading of the vtnet(4) driver to disabled (contributed by Patrick M. Hausen)
• system: add support for RFC 5549 routes and refactor static route creation code
• system: improve notification support to also allow persistent notifications and static banners
• system: add notifications for low disk space and OpenSSH file override use
• system: migrate tunables page to MVC/API
• system: switch to temperature sensor caching
• system: add certificate widget to track expiration dates and allow quick renewal
• system: remove deprecated “page-getserviceprovider”, “page-dashboard-all” and “page-system-groupmanager-addprivs” privileges
• system: replace file_get_contents() with curl implementation in XMLRPC sync and add verifypeer option
• system: add item edit links to several dashboard widgets
• system: prioritize index page and prevent redirection to a /api page on login
• system: mute disk space status in case of live install media
• system: optimize system status collection
• system: exclude pchtherm thresholds temperature thresholds
• system: update button wording on new HA status page
• system: adjust gateway widget to use the intended caching mechanism
• system: thermal sensors widget can now select individual sensors to display plus UX changes
• system: handle dev.pchtherm temperatures in the thermal dashboard widget (contributed by Joe Roback)
• system: use new apply button partial in tunables page
• system: move high availability option “disable preempt” to advanced mode
• system: straighten out syslog-ng rc.d scripting
• system: implement user CSV import/export functionality (sponsored by: m.a.x. it)
• system: switch boot logo and MOTD to the new-style logo (contributed by Gavin Chappell)
• system: migrate “default” tunable value to empty one and improve UX
• system: replace legacy service widget hook with a proper configd call
• system: add “Kill states when down” option to gatways
• system: stop pushing “nextuid” and “nextgid” during XMLRPC
• system: migrate tunables to implicit defaults
• system: secure access to sysctl configuration node
• system: fix RADIUS error check
• system: rewire system_usermanager_passwordmg.php to /ui/user_portal for cooperation with the next business edition
• system: default “net.inet.carp.senderr_demotion_factor” tunable to “0”
• system: opnsense-beep: serialize access to /dev/speaker (contributed by Leonid Evdokimov)
• system: fix URL hash in certificate link so redirection shows the correct menu path
• system: add a user portal for self-servicing OTP and OpenVPN profiles
• reporting: fix missing typecast in epoch range for DNS statistics
• reporting: switch health graphs to ChartJS
• reporting: minor code cleanups in insight backend
• interfaces: adhere to DAD during VIP recreation in rc.newwanipv6
• interfaces: remove non-functional features from bridges
• interfaces: remove PPP edit in interfaces settings
• interfaces: batched device type creation under “Devices” submenu
• interfaces: move PPP and wireless logs to system log
• interfaces: remove “Use IPv4 connectivity” setting as it will be set by default
• interfaces: fix undefined array key warnings in DHCP client setup (contributed by Ben Smithurst)
• interfaces: add “nosync” option to VIPs and fix sync conditional
• interfaces: use shared base_bootgrid_table and base_apply_button where possible
• interfaces: remove obsolete code in get_real_interfaces() to match getRealInterface()
• interfaces: improve validation for CARP/proxy ARP VIP
• interfaces: remove defunct “other” VIP type
• interfaces: skip “nosync” processing on VIPs
• interfaces: move “(de)select all” button to the same row on packet capture page
• interfaces: add ARP address family option to packet capture
• interfaces: fix advanced mode visibility in VIPs
• firewall: use “skip lo0” instead of policing lo0 explicitly following OpenBSD best practice
• firewall: remove duplicate table definition and make sure bogonsv6 table always exists
• firewall: cleanup of CARP and IPv6 rules behaviour
• firewall: filter feature parity in automation rules
• firewall: offer multi-select on source and destination addresses
• firewall: add experimental inline shaper support to filter rules
• firewall: add missing columns on one-to-one NAT page
• firewall: fix anti-lockout and “allow access to DHCP failover” automatic rules
• firewall: add optional authorization for URL type aliases
• firewall: add “URL Table in JSON format (IPs)” alias type
• firewall: properly unpack multiple source/destination items in the rules page
• firewall: hide internal aliases to align with previous legacy_list_aliases() function
• firewall: support partial alias exports
• firewall: performance improvement by using pf overall table stats instead of dumping each table
• firewall: offer better plug-ability for dynamic alias type
• firewall: alias rename action ignored due to missing lock
• firewall: support “jq” processing syntax for JSON-based URL table aliases
• firewall: fix presentation when alias name overlaps group name
• captive portal: fix missing class import
• captive portal: partially revert new lighttpd TLS defaults
• captive portal: urlencode() selector items in voucher group list
• dhcrelay: integrate layout_partials bootgrid/apply
• dnsmasq: migrate existing frontend to MVC/API
• firmware: fix “r” abbreviation vs. version_compare();
• firmware: opnsense-update: fix failure to clean up the working directory
• firmware: opnsense-update: support -B and -K with -c option check
• firmware: opnsense-update: let -u skip already installed packages set
• firmware: kernel may not be pending so be sure to check on upgrade attempt
• firmware: add an upgrade test for wrong pkg repository
• firmware: revoke 24.7 fingerprint
• installer: fixed missing prompt and help text in ZFS disk selection
• installer: warn on low RAM for ZFS as well
• installer: added a power off option
• intrusion detection: policy content dropdown missing data-container
• ipsec: add log search button in sessions
• ipsec: add banner message when using custom configuration files
• ipsec: fix glob pattern for advanced configuration banner
• ipsec: add deprecation notices for legacy components (will move to plugins)
• ipsec: pre-shared key permission fix
• kea-dhcp: add “v6-only-preferred” option (contributed by darses)
• kea-dhcp: use shared base_bootgrid_table and base_apply_button
• kea-dhcp: add missing ACL privileges
• lang: update available translations
• monit: flag file overwrites when they exist
• network time: take IPv6 addresses into account
• network time: remove support for explicit VIP selection
• network time: move XMLRPC definition to correct file
• openvpn: add validation pertaining to auth-gen-token and reneg-sec combinations
• openvpn: add deprecation notices for legacy components (will move to plugins)
• openvpn: add DCO validation for fragment size
• openvpn: use shared base_bootgrid_table and base_apply_button
• openvpn: add support for assorted options (contributed by Marius Halden)
• openvpn: add basic HTTP client option
• openvpn: add “Enable static challenge (OTP)” option in client export
• router advertisements: move plugin code to its own space
• unbound: cleanup available blocklists and add hagezi blocklists
• unbound: fix root.hits permission on copy
• unbound: flag file overwrites when they exist
• unbound: add support for forward-first when configuring forwarders (contributed by Nigel Jones)
• unbound: use shared base_bootgrid_table and base_apply_button
• unbound: move whitelist (passlist) handling to Unbound plugin
• unbound: drop “exclude” phrase from plugin log entry
• wireguard: change tracking of peer status, improve widget and diagnostic
• wireguard: use shared base_bootgrid_table and base_apply_button
• backend: -m option is unused so remove its complication
• backend: add an “import” rc.syshook facility
• backend: change the “monitor” rc.syshook facility and de-deprecate its use
• backend: remove unused functions and move once-used functions to their call script
• backend: allow pluginctl to filter on -x/-X option
• mvc: implement reusable grid template using form definitions
• mvc: add Default() method to reset a model to its factory defaults
• mvc: fix LegacyMapper when the mount point is not the XML root
• mvc: fields should implement getCurrentValue() rather than __toString()
• mvc: fix value lookup in LinkAddressField
• mvc: memory preservation fix in BaseListField
• mvc: support lazy loading on alias models and use it in NetworkAliasField
• mvc: wrap locks around updates and perform some minor cleanups in ApiMutableModelControllerBase
• mvc: move “lazy loading” option to base model implementation and force usage on run_migrations.php
• mvc: safeguard checkToken() to prevent fetching an non existing POST item
• mvc: decode HTML tags in menu items
• mvc: fix unit tests for model relation fields
• mvc: merge NetworkValidator into NetworkField to ease extensibility and add unit test
• mvc: send audit messages emitted in the authentication sequence to proper channel
• ui: upgrade Font Awesome icons to version 6
• ui: push search/edit logic towards bootgrid implementation
• ui: improved links with automatic edit and/or search
• ui: rewritten default theme for a light look and new logo
• ui: added default theme variant with a dark look
• ui: header image scaling fixes in default light theme
• ui: remove right border from “aside” element in default dark theme
• ui: upgrade ChartJS to v4
• ui: change backdrop background color to black in dark theme
• ui: create a unified layout partial for the apply button
• plugins: adjust all themes for ChartJS 4 use
• plugins: os-OPNBEcore 1.5
• plugins: os-OPNWAF 1.8
• plugins: os-OPNcentral 1.11
• plugins: os-acme-client 4.9
• plugins: os-caddy 1.8.4
• plugins: os-cpu-microcode 1.1 removes unneeded late loading code
• plugins: os-crowdsec 1.0.9
• plugins: os-ddclient 1.27
• plugins: os-dmidecode 1.2 adds new dashboard widget (contributed by Neil Merchant)
• plugins: os-frr 1.44
• plugins: os-haproxy 4.5
• plugins: os-intrusion-detection-content-pt-open 1.0 (contributed by kulikov-a)
• plugins: os-sftp-backup 1.0 allows configuration backups over SFTP
• plugins: os-tailscale 1.2
• plugins: os-theme-cicada 1.39 (contributed by Team Rebellion)
• plugins: os-theme-tukan 1.29 (contributed by Team Rebellion)
• plugins: os-theme-vicuna 1.49 (contributed by Team Rebellion)
• plugins: os-zabbix-agent 1.15
• plugins: os-zabbix-proxy 1.12
• src: FreeBSD 14.2-RELEASE
• src: bpf: fix potential race conditions
• src: carp: fix checking IPv4 multicast address
• src: e1000: fix vlan PCP/DEI on lem(4)
• src: icmp: use per rate limit randomized jitter
• src: if_vxlan: invoke vxlan_stop event handler only when the interface is configured
• src: if_vxlan: prefer SYSCTL_INT over TUNABLE_INT
• src: if_vxlan: use static initializers
• src: ifconfig: make -vht work
• src: ifnet: detach BPF descriptors on interface vmove event
• src: igc: remove unused register IGC_RXD_SPC_VLAN_MASK
• src: ipfw: add missing initializer for “limit” table value
• src: ipfw: make “ipfw show” output compatible with “ipfw add” command
• src: iwlwifi: update Intel iwlwifi/mvm driver et al
• src: ixgbe: add ixgbe_dev_from_hw() back
• src: ixgbe: fix a logic error in ixgbe_read_mailbox_vf()
• src: ktrace: fix uninitialized memory disclosure]
• src: libkern: add ilog2 macro et al
• src: net80211: 11ac: add options to manage VHT STBC
• src: net: if_media for 100BASE-BX
• src: netinet6: do not forward to the unspecified address
• src: netinet: do not forward or ICMP response to INADDR_ANY
• src: netinet: ipsec and ktls cannot coexists
• src: pf: add “allow-related” to always allow SCTP multihome extra connections
• src: pf: add extra SCTP multihoming probe points
• src: pf: align sanity checks for pfrw_free
• src: pf: allow ICMP messages related to an SCTP state to pass
• src: pf: allow all forms of neighbor advertisements in either direction
• src: pf: cleanup leftover * code that is not needed anymore
• src: pf: do not keep state when dropping overlapping IPv6 fragments
• src: pf: drop IPv6 packets built from overlapping fragments in pf reassembly
• src: pf: fix fragment hole count
• src: pf: force logging if pf_create_state() fails
• src: pf: only force state failure logging if logging was requested
• src: pf: send ICMP destination unreachable fragmentation needed when appropriate
• src: pf: stop using net_epoch to synchronize access to eth rules
• src: pf: verify SCTP v_tag before updating connection state
• src: pf: verify that ABORT chunks are not mixed with DATA chunks
• src: pfil: set PFIL_FWD for IPv4 forwarding
• src: rtw89: update Realtek rtw88/rtw89 driver et al
• src: sysctl: enable vnet sysctl variables to be loader tunable
• src: tzdata: import tzdata 2025a
• ports: ca_root_nss 3.108
• ports: curl 8.12.1
• ports: dnsmasq 2.91
• ports: expat 2.7.0
• ports: lighttpd 1.4.78
• ports: monit 5.34.4
• ports: nss 3.109
• ports: openssl 3.0.16
• ports: openvpn 2.6.14
• ports: pcre2 10.45
• ports: pecl-radius now offers message authenticator support (scheduled to be enabled with 25.4.2)
• ports: pftop 0.12
• ports: phalcon 5.9.0
• ports: php 8.3.19
• ports: py-duckdb 1.2.1
• ports: py-jq 1.8.0
• ports: radvd 2.20
• ports: suricata 7.0.10

Migration notes, known issues and limitations:

• The access management was rewritten in MVC and contains behavioural changes including not rendering UNIX accounts for non-shell users. The integrated authentication via PAM has been the default for a long time so the option to disable it has been removed. The manual LDAP importer is no longer available since LDAP/RADIUS authenticators support on-demand creation and default group setup option. The “page-system-groupmanager-addprivs” privilege was removed since the page does not exist anymore. A multi-purpose privilege editor has been added under the existing “page-system-usermanager-addprivs” instead.
• PPP devices can no longer be configured on the interface settings page. To edit the device settings use the native PPP device edit page instead.

The public key for the 25.4 series is:

# -----BEGIN PUBLIC KEY-----
# MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsnbyFjWXvUcUC4BqnQ9w
# uH3yiaG7AY8UzwepXf2TqqOYt5Y0USbse3OBjxYnRs0iW5EHtdKSRcmelup374Hp
# XDDeQ/mjmhhnvXryfQL57gyVpYeL5gRVhf/2DwEZELLCFUFhMNh52QPaJ5zTvdws
# m1Q+OwI1WfTDR7ytm+0Too2tVerG3mM3XataZ+XOKwHp2xP0Mr8E4F+PZdR4hWbb
# yC2elIzICXDWWpcEEg4JT48TIYZJPGnE2IJAzWRntrqVU2eLcEn5MffwTawXNoCZ
# mvLYqguYskmeR/dAL7ZmZcPeMeibXMtld8xIZp49g7DPq7PqxCY1wxcgeuZPFOHv
# kbYzL3BHbyni3K/qdLXKzy8oZeUUvlbUgaj8Xx14DSiNzJDknNf0Xg/eby7MkzgP
# eUXgtB0MRQMih85BfaiH5r+uQMgPKnjutVWR8qUWglxDKIc4s69b8PXylfu2FwiP
# iKMBdO8xnVvNFKOkuaUtI31cqxauw2hBAlILFvltM+adUz2rfB3Ch0bjfjDE5Hxq
# En4fEUVHgQCu+Ojyyy3/8RwUpsRZq05fObypyeL3E/MvlwpaOVjwvw2ozVPGi2zi
# xmXemn5CbgjD3vPR9XERXrFkHTwPnIiqz53znqn34P+NGEgD1veMhZPE6OGZRu/h
# IfceSaxJ/An5SUh0zr7YgOsCAwEAAQ==
# -----END PUBLIC KEY-----

SHA256 (OPNsense-business-25.4-dvd-amd64.iso.bz2) = 6b99523d8b8f166ea6fc1e30de3206da8f5184fc36f646d3cefd3b2409930f49

SHA256 (OPNsense-business-25.4-nano-amd64.img.bz2) = 1aa61b516ea61491c3b5c438c7d003d6f0812cc4638ddd767f4fe0e2f89ad0ea

SHA256 (OPNsense-business-25.4-serial-amd64.img.bz2) = d54c59bbfb89282cc5dc7a40b1c0b42b0c616e23f70700c2d2aeb32ab9474509

SHA256 (OPNsense-business-25.4-vga-amd64.img.bz2) = cb95d7cc0ef9c8875173bbaf4bd852c477ff1e1d529387fdb6f08be38041eda6

This business release is based on the OPNsense 24.7.12 community version with additional reliability improvements.

Here are the full patch notes:

system

• add a “time-loop” around authentication for failed attempts
• remove the SSL bundles in default locations
• prevent JS crashing out when dashboard widget title is not set
• use system instead of sample defaults when reverting tunables
• report actual LAN address being used after factory reset
• fix TOTP regression when used with LDAP
• show multiple SAN entries when supplied by the certificate
• traffic dashboard widget should persist interface identifiers
• reset dashboard widget options to the default if none of the options match
• mismatch in returned “change” attribute for route toggle
• suppress XML parse errors in announcement widget when forum is unreachable
• catch PHP errors for Google Drive backups
• ignore plugins_interfaces() errors in write_config()
• fix snapshot ACL
• re-enable support for subjectAltName when creating CSRs
• remove spurious backup() during config revert

reporting

• add daemon -f parameter to close file descriptors for NetFlow local capture (contributed by Ben Smithurst)

interfaces

• use Autoconf class to avoid raw ifctl file access
• remove ancient MAC address trickery to unbreak hostapd
• add missing neighbor and DNS lookup page ACL entries
• PPP device page ACL missed getserviceproviders.php
• reload GUI in the background

dhcp

• allow radvd to use /128 CARP VIP as source

firewall

• remove faulty PPP exclusion in scrubbing rule creation

firmware

• improved output helpers and associated cleanup in audit scripts
• opnsense-update: add support for regression tests set
• add “configctl firmware changelog current” backend command
• refactor lock/unlock scripts using new output helpers
• opnsense-code: support for origin selection during upgrade mode
• opnsense-patch: improve patch behaviour for non-default account/repositories combinations
• fix the return value handling in the firmware option of the console menu
• use output_cmd/output_txt helpers in remaining scripts
• disable duckdb migration for stable transition again

intrusion detection

• limit stats.log logging (contributed by doktornotor)

ipsec

• remove hashing algorithm from null cipher
• fix mobile clients reload missing system.inc

isc-dhcp

• IPv6 prefixes script can fail to restart (contributed by Ben Smithurst)

kea-dhcp

• add dhcp-socket-type option (contributed by Till Niederauer)
• add MAC formatter to leases page (contributed by cpalv)
• align hostname validation with manual host entries
• add “match-client-id” in subnet definitions

openvpn

• support case-insensitive strict user CN matching for instances

unbound

• move domain overrides to query forwarding
• use tls-cert-bundle to point to remaining valid bundle
• fixup permission on copy

mvc

• let JsonKeyValueStoreField cache configd call for the duration of the session
• another batch of sessionClose() cleanups in controllers
• cleanup in ApiMutableServiceControllerBase
• fix hint display for “0”
• last batch of sessionClose() cleanups in controllers
• call initialize() after authentication
• normalize multiple slashes in paths
• fix a regression in “normalize multiple slashes in paths”
• add serialNumber and issuer in Store::parseX509()
• restore support for JSON input data without configd callout in JsonKeyValueStoreField
• fix NetworkValidator for IPv4-mapped addresses with netmask (contributed by John Fieber)

ui

• restore right tab border in standard theme
• add classes to system history diff content so themes can override the defaults
• load CSV as text to prevent encoding issues in SimpleFileUploadDlg()

plugins

• turning binary data into JSON may fail globally
• os-acme-client 4.7
• os-caddy 1.8.0
• os-ddclient 1.26
• os-debug 1.7
• os-freeradius 1.9.27
• os-haproxy 4.4
• os-mdns-repeater 1.2
• os-nut 1.9
• os-qemu-guest-agent 1.3
• os-squid 1.1
• os-tailscale 1.1 (contributed by Sheridan Computers)
• os-telegraf 1.12.12
• os-theme-rebellion 1.9.2 (contributed by Team Rebellion)

src

• atf/kyua: ship regression tests runtime support
• if_bridge: mask MEXTPG if some members do not support it
• if_tuntap: enable MEXTPG support
• ice: update to 1.43.2-k et al
• ipsec: fix IPv6 over IPv4 tunneling
• ixgbe: add support for 1Gbit (active) DAC links
• ixgbe: sysctl for TCP flag handling during TSO
• jail: expose children.max and children.cur via sysctl
• libfetch: add the error number to verify callback failure case
• netlink: assorted stable backports
• pf: prevent SCTP-based NULL dereference in pfi_kkif_match()
• pf: let rdr rules modify the src port if doing so would avoid a conflict
• pf: make pf_get_translation() more expressive
• pf: let pf_state_insert() handle redirect state conflicts
• pf: fix wrong pflog action in NAT rule
• rc: ignore INSYDE BIOS placeholder UUID for /etc/hostid
• route: fix failure to add an interface prefix route when route with the same prefix is already presented in the routing table
• route: route: avoid overlapping strcpy
• sfxge: defer ether_ifattach to when ifmedia_init is done
• netlink: allow force remove on pinned delete from route binary
• if_ovpn: improve reconnect handling
• iflib: set the NUMA domain in receive packet headers
• ip: defer checks for an unspecified dstaddr until after pfil hooks
• ice_ddp: update to 1.3.41.0
• p9fs: add an implementation of the 9P filesystem
• tarfs: fix the size of struct tarfs_fid and add a static assert
• ext2fs: fix the size of struct ufid and add a static assert
• cd9660: make sure that struct ifid fits in generic filehandle structure
• audit: fix short-circuiting in syscallenter()
• svc.c: check for a non-NULL xp_socket
• carp: do npt unintentionally revert to multicast mode
• netinet: enter epoch in garp_rexmit()

ports

• curl 8.11.1
• expat 2.6.4
• libpfctl 0.15
• monit 5.34.3
• nss 3.107
• openldap 2.6.9
• openvpn 2.6.13
• php 8.2.27
• python 3.11.11
• sudo 1.9.16p2
• suricata 7.0.8

hotfix release 24.10.2_6

• interfaces: exclude automatic radvd like we do for manual
• firewall: fix unassociated rule creation
• intrusion detection: cleanse metadata for brackets
• openvpn: support “password first” for static-challenges
• unbound: fix model migration pertaining to “dots” model changes
• plugins: treat empty string like null on argument map
• ports: openssh 9.9p2
• ports: py-jinja 3.1.6

hotfix release 24.10.2_8

• system: compatibility shims for upcoming user model changes
• firmware: add fingerprint, migration notes and upgrade hint for 25.4

This business release is based on the OPNsense 24.7.9 community version with additional reliability improvements.

We subsequently republished the images as 24.10.1 due to CRL verification issues in the initial 24.10 version which were quickly hotfixed, but could not easily be fixed in the existing images.

Here are the full patch notes:

system

• remove obsolete banners from static pages
• address CRL/cert subject hash mismatch during trust store rehash
• add missing MinProtocol in OpenSSL config template from trust settings
• add SignatureAlgorithms option and fix minor form glitch in trust settings
• sync certctl to FreeBSD 14.1 base code et al
• migrate authoritative bundle location to /usr/local/etc/ssl/cert.pem
• flush the global OpenSSL configuration to /etc/ssl/openssl.cnf as well
• ignore gateway monitor status on boot when setting up routes
• fix IP address validation not being displayed in the gateway form

reporting

• refactor existing RRD backend code
• isset() vs. empty() on RRD enable
• fix regression in RRD temperature readings
• ISO dates and logical ranges in health graphs (contributed by Roy Orbitson)

interfaces

• fix VXLAN interface being busy when vxlanlocal or vxlanremote is changed
• 6RD/6to4 route creation should be limited to IPv6
• parse part of SFP module information in legacy_interfaces_details()
• kill defunct route-to states with the stale gateway IP

firewall

• add a note about stateless TCP during syncookie use
• enhance validation that group name can not start or end with a digit
• make loopback traffic stateful again to fix its use with syncookie option
• add “Action” property to list of retrieved rules
• use UUIDs as rule labels to ease tracking

firmware

• remove escaped slashes workaround on mirror/flavour write
• introduce config.sh and use it in launcher.sh and connection.sh
• restart cron on updates
• improve health script and use config.sh
• rework CRL check in config.sh
• use the trust store for CRL verification
• refactor for generic config.sh use and related code audit
• move the bogons update script to the firmware scripts, improve logging messages and use config.sh
• opnsense-version: restored pre-2019 default output format (contributed by TotalGriffLock)
• use REQUEST to print a TLS/CRL usage hint
• force CRL check on development deployment

intrusion detection

• reorganise settings page with headers
• support configuration of eve-log for HTTP and TLS (contributed by Toby Chen)

ipsec

• add swanctl.conf download button to settings page
• add description field to pre-shared-keys

isc-dhcp

• safeguard output type for json_decode() in leases page

openvpn

• add Require Client Provisioning option for instances

unbound

• allow RFC 2181 compatible names in overrides

backend

• correct template helper exists() return type (contributed by kumy)
• add “configd environment” debug action

lang

• update available translations

mvc

• extend sanity checks in isIPInCIDR()
• fix UpdateOnlyTextField incompatibility with DependConstraint (contributed by kumy)
• always do stop/start on forced restart
• remove obsolete sessionClose() use in Base, Firmware, Unbound and WireGuard controllers

ui

• fix tree view style targeting elements outside this view

plugins

• enforce defaults on devices
• os-bind 1.33
• os-caddy 1.7.4
• os-ddclient 1.25
• os-debug 1.6
• os-etpro-telemetry lowers log level of collection invoke (contributed by doktornotor)
• os-freeradius 1.9.26
• os-frr 1.42
• os-iperf fixes JS TypeError when parsing result (contributed by Leo Huang)
• os-lldpd 1.2
• os-ndproxy 1.0 adds an IPv6 Neighbour Discovery proxy
• os-net-snmp 1.6
• os-tinc removes “pipes” Python module dependency (contributed by andrewhotlab)
• os-upnp 1.7
• os-wazuh-agent 1.2

src

• multiple issues in the bhyve hypervisor
• unbounded allocation in ctl(4) CAM Target Layer
• XDG runtime directory file descriptor leak at login
• assorted FreeBSD stable patches for Intel ixgbe, igb, igc and e1000 drivers
• cxgb: register ifmedia callbacks before ether_ifattach
• enc: use new KPI to create enc interface
• ifconfig: fix wrong indentation for the status of pfsync
• iflib: simplify iflib_legacy_setup
• iflib: use if_alloc_dev() to allocate the ifnet
• netmap: make memory pools NUMA-aware
• vlan: handle VID conflicts

ports

• libpfctl 0.14
• monit 5.34.2
• nss 3.106
• openssh 9.9p1
• php 8.2.25
• py-duckdb 1.1.3
• syslog-ng 4.8.1
• unbound 1.22.0

SHA256 checksums for images included.

The OPNsense business edition transitions to this 24.10 release including ZFS snapshot support via GUI/API, rewritten dashboard, system trust MVC/API support, GRE and GIF MVC/API support, NAT 1-to-1 MVC/API support, WireGuard QR code generator, dynamic IPsec VTI tunnel support, experimental OpenVPN DCO support, FreeBSD 14.1, Python 3.11 plus much more.

Please make sure to read the migration notes before upgrading.

Download link is as follows. An installation guide and the checksums for the images can be found below as well.

This business release is based on the OPNsense 24.7.6 community version with additional reliability improvements.

Here are the full patch notes:

system

• remove “load_balancer” configuration remnants from core
• replace usage of mt_rand() with random_int()
• rewrote Trust configuration using MVC/API
• add XMLRPC option for OpenDNS
• rewrote the high availability settings page using MVC/API
• remove obsolete SSH DSA key handling
• replaced the dashboard with a modern alternative with streaming widgets
• harden a number of PHP settings according to best practices
• support streaming of log files for the new dashboard widget
• assorted dashboard widget tweaks
• sidebar optimisation and fixes (contributed by Team Rebellion)
• set short Cache-Control lifetime for widgets
• fix disk widget byte unit “B” parsing crashing the whole widget
• increase widget timeout to 5 seconds
• cores and threads flipped in system widget
• increase the PHP children count of the web GUI
• guard destroy on traffic widget
• adjust address display in interfaces widget
• fix display of multiple sources in thermal sensor widget
• add load average back to system info widget
• remove dots from traffic widget graphs
• add publication date to announcement widget
• fix monit widget status code handling
• allow and persist vertical resize in widgets
• improve formatting of byte values in widgets
• update OpenVPN widget server status color
• add aggregated traffic information about connected children in IPsec widget
• remove animated transition from row hover for table widgets
• improve the styling of the widget lock button
• apply locked state to newly added widgets as well
• account for removal of rows in non-rotated widget tables with top headers
• use “importmap” to force cache safe imports of base classes for widgets
• allow custom fonts in the widgets with gauges (contributed by Jaka Prašnikar)
• add monitor IP to gateway API result (contributed by Herman Bonnes)
• better define “in use” flag and safety guards in certificates section
• export p12 resulted in mangled binary blob in certificates section
• when using debug kernels prevent them from triggering unrelated panics on assertions
• switch Twitter to Reddit URL in message of the day
• fix API exception on empty CA selection
• CRL import ignored text input and triggered unrelated validations
• improve the locking during web GUI restart
• improve WireGuard and IPsec widgets
• add CPU widget graph selection
• reformat traffic graphs to bps
• add gateway widget item selection
• add table view to interface statistics widget on expansion
• improve widget error recovery
• fix wrong variable assignment in system log search backend
• add missing delAction() for proper CRL removal
• remove obsolete dashboard sync
• compact services widget on dashboard
• convert lock mode to edit mode on dashboard
• change dashboard modify buttons to a bootstrap group (contributed by Jaka Prašnikar)
• use built-in controller logic for JSON decoding on dashboard
• map derivative field cert_type to expose purpose to the UI
• handle stale “pfsyncinterfaces” and improve workflow
• tweak the boot detection for code minimalism
• do not save x/y widget coordinates on smaller screens
• fix CARP widget on invalid CARP configuration
• fix storing private key when creating a CSR
• update default dashboard layout and include the services widget
• render header for failed active widgets to allow identification and removal
• add ability for widget referral links
• cleaned up ACL definitions and use thereof
• add a picture widget
• default to vm.numa.disabled=1
• handle log lines with no timestamp (contributed by Iain MacDonnell)
• use interface maps in system_routing_configure() and dpinger_configure_do()
• when only selecting TLS1.3 ciphers make sure to only allow 1.3 as well in web GUI
• move web GUI restart to newwanip_map / plugins_argument_map() use
• due to observed timing issues avoid the use of closelog()
• do not render non-reachable dashboard widget links
• handle picture deletion via hidden input on general settings page
• straighten out API ACL entries for several components
• remove unreachable “page-getstats” ACL entry
• adjust “page-system-login-logout” ACL entry to be used as a minimal dashboard privilege
• deprecate the “page-dashboard-all” ACL entry as it will be removed in 25.1
• add descriptions on CA and certificate downloads file names
• show user icon when certificate is not otherwise used (in case CN matches any of our registered users)
• add proper validation when certificates are being imported via CSR
• add missing CRL changed event when CRLs are saved in the GUI
• add a trust settings page and move existing trust settings there as well
• optionally fetch and store CRLs attached to trusted authorities
• improve and extend certctl.py script doing the trust store rehashing
• enforce CRL behaviour for existing revocations in the trust store when doing remove syslog sending over TLS
• untrusted directory changed in FreeBSD 14
• add OpenSSH “RekeyLimit” with a limited set of choices
• improve context of changed/modified message in certctl.py

reporting

• start using cron for RRD collection
• remove nonexistent 3G statistics

interfaces

• rewrote GRE configuration using MVC/API
• rewrote GIF configuration using MVC/API
• temporary flush SLAAC addresses in DHCPv6 WAN mode to avoid using them primarily
• add peer/peer6 options to CARP VIPs
• allow to assign a prefix ID to WAN interface in DHCPv6 as well
• allow to set manual interface ID in DHCPv6 and tracking modes
• improve apply of the new peer/peer6 options to avoid unneeded reset
• avoid deprecating SLAAC address for now
• require PPP interface to be in up state (contributed by Nicolai Scheer)
• lock down PPP modes when editing interfaces
• backport required interface_ppps_capable()
• retire interfaces_bring_up()
• add “newwanip_map” event and deprecate old “newwanip” one
• keep 24.7 backwards compatibility by allowing 6RD and 6to4 on PPP
• add logging to PPP link scripts to check for overlap
• return correct uppercase interface name in getArp()
• fix issue with PPP port not being posted
• force regeneration of link-local on spoofed MAC
• add proper validation for 6RD and 6to4
• add new “vpn_map” event to deprecate “vpn”
• unify PPP linkup/linkdown scripting
• replace “newwanip” from interface apply with “early”
• move IPv6 over IPv4 connectivity to a separate script
• port VXLAN to newwanip_map event
• fix PPP regression of empty gateway default
• move compatible event listeners to newwanip_map
• decouple PPP configure/reset from IPv4/IPv6 modes
• move legacy RFC2136 invoke to plugin hook
• add “spoofmac” device option and enforce it
• prevent CARP VIP removal when VHID group is in use by IP aliases
• routing configuration on changed interfaces only during apply
• simplify and clarify pfsync reconfiguration hooks
• non-functional refactors in PPP configuration
• send IPv6 solicit immediately on WAN interfaces

firewall

• performance improvements in alias handling
• refactor pftop output, move search to controller layer and implement cache for sessions page
• support streaming of filter logs for the new dashboard widget
• fix one-to-one NAT migration with external address without a subnet set
• fix parsing port alias names in /etc/services
• replace filter_(un)lock() with a FileObject lock
• add gateway groups to the list of gateways in automation rules

captive portal

• add “Allow inbound” option to select interfaces which may enter the zone
• remove defunct transparent proxy settings
• clean up the codebase
• fix client disconnect (contributed by Vivek Panchal)

dhcrelay

• start on “newwanip_map” event as well
• refactor for plugins_argument_map() use

firmware

• revoke 24.4 fingerprint
• remove inactive mirrors from the list
• introduce sanity checks prior to upgrades
• cleanup package manager temporary files prior to upgrades
• remove auto-retry from fetch invokes
• allow auto-configure patching via full URL
• automatically handle most plugin conflicts
• opnsense-update: support unescaped mirror input (contributed by Michael Gmelin)
• opnsense-verify: show repository priority while listing active repositories
• CRL checking for business update mirror

intrusion detection

• update the default suricata.yaml (contributed by Jim McKibben)
• fix indent in suricata.yaml

ipsec

• prevent gateway when remote gateway family does not match selected protocol in legacy tunnel configuration
• add aggregated traffic totals to phase 1 view
• advanced settings MVC/API conversion
• add retransmission settings in charon section in advanced settings
• move two logging settings to correct location misplaced in previous version
• fix migration and regression during handling of “disablevpnrules” setting
• convert to vpn_map event invoke and plugins_argument_map() use
• add “make_before_break” option to settings
• fix advanced option “max_ikev1_exchanges”

isc-dhcp

• do not reload DNS services when editing static mappings to match behaviour with Kea

kea-dhcp

• ignore invalid hostnames in static mappings to prevent DNS services crashes
• add configurable “max-unacked-clients” parameter and change its default to 2

monit

• expose HTTPD username and password settings to GUI
• fix undefined function error in CARP script

network time

• enable “restrict noquery” by default (contributed by doktornotor)

openssh

• convert to newwanip_map and rework the code
• port to plugins_argument_map()

openvpn

• optionally support DCO devices for instances
• remove duplicate and irrelevant data for the client session in question
• add “remote_cert_tls” option to instances
• disable DCO permanently in legacy client/server configuration
• use new trust model to link users by common_name in exporter
• DCO mode only supports UDP on FreeBSD
• unhide server fields for DCO instances
• validate “Auth Token Lifetime” to require a non-zero renegotiate time in instances
• convert to vpn_map event invoke and plugins_argument_map() use
• fix “auth-gen-token” being supplied in server mode
• register OpenVPN group immediately when setting up instances
• push “data-ciphers-fallback” in client export when configured to align with legacy setup

unbound

• add discard-timeout (contributed by Nigel Jones)
• port to newwanip_map / plugins_interface_map()

wireguard

• support CARP VHID reuse on different interfaces
• fix widget display with public key reuse
• convert to vpn_map event invoke

backend

• add “cache_ttl” parameter to allow for generic caching of actions
• run default action “configd actions” when none was specified
• extended support for streaming actions
• patch -6 address support into pluginctl
• cache file cleanup when TTL is reached

installer

• update the ZFS install script to the latest FreeBSD 14.1 code
• prefer ZFS over UFS in main menu selection

mvc

• replaced most of the Phalcon MVC use with a native band compatible implementation
• improve searchRecordsetBase() filtering capabilities
• remove obsolete getParams() usage in ApiControllerBase
• hook default index action in API handler
• fix API regression due to getParams() removal
• make Response->setContentType() second argument optional
• fix API endpoint sending data without giving the Response object the chance to flush its headers
• remove setJsonContent() and make sure Response->send() handles array types properly
• FileObject write() should sync by default
• when a hint is provided, also show them for selectpickers

rc

• export default ZPOOL_IMPORT_PATH
• fix banner HTTPS fingerprint

ui

• assorted improvements for screen readers (contributed by Jason Fayre)
• add “select all” to standard form selectors and remove dialog on “clear all” for tokenizers
• lock save button while in progress to prevent duplicate input on Bootgrid
• backport accessibility fix in Bootstrap
• sidebar submenu expand fix (contributed by Team Rebellion)
• refine cookie policies and make them explicit
• remove bold text from tab headers for consistency

plugins

• add plugins_argument_map() helper
• os-OPNWAF 1.6 with multiple new features (see info in firmware plugins tab for details)
• os-acme-client 4.6
• os-apcupsd 1.2
• os-caddy 1.7.2
• os-cpu-microcode-amd 1.0
• os-cpu-microcode-intel 1.0
• os-ddclient 1.24
• os-dec-hw 1.1 replaces the dashboard widget
• os-etpro-telemetry 1.7 replaces dashboard widget
• os-freeradius 1.9.25
• os-frr 1.41
• os-helloworld 1.4
• os-intrusion-detection-content-snort-vrt 1.2 switch to newer ruleset snapshot (contributed by Jim McKibben)
• os-nginx 1.34
• os-smart 2.3 adds new dashboard widget (contributed by Francisco Dimattia)
• os-theme-advanced 1.0 based on AdvancedTomato (contributed by Jaka Prašnikar)
• os-theme-cicada 1.38 (contributed by Team Rebellion)
• os-theme-rebellion 1.9.1 fixes more compatibility issues with new dashboard (contributed by Team Rebellion)
• os-theme-tukan 1.28 (contributed by Dr. Uwe Meyer-Gruhl)
• os-theme-vicuna 1.48 (contributed by Team Rebellion)
• os-udpbroadcastrelay API error fixes (contributed by Team Rebellion)
• os-upnp 1.6
• os-wol 2.5 adds widget for new dashboard (contributed by Michał Brzeziński)

src

• FreeBSD 14.1-RELEASE
• assorted backports from FreeBSD stable/14 branch
• ktrace(2) fails to detach when executing a setuid binary
• NFS client accepts file names containing path separators
• xen/netfront: Decouple XENNET tags from mbuf lifetimes
• dummynet: fix fq_pie traffic stall
• mcast: fix leaked igmp packets on multicast cleanup
• wg: change dhost to something other than a broadcast address (contributed by Sunny Valley Networks)
• axgbe: implement ifdi_i2c_req for diagnostics information
• if_clone: allow maxunit to be zero
• if_pflog: limit the maximum unit via the new KPI
• pf: vnet-ify pf_hashsize, pf_hashmask, pf_srchashsize and V_pf_srchashmask
• u3g: add SIERRA AC340U
• agp: Set the driver-specific field correctly
• cron(8) / periodic(8) session login
• multiple vulnerabilities in libnv
• bhyve(8) privileged guest escape via TPM device passthrough
• multiple issues in ctl(4) CAM target layer
• bhyve(8) privileged guest escape via USB controller
• possible DoS in X.509 name checks in OpenSSL
• umtx kernel panic or use-after-free
• revert “ixl: fix multicast filters handling”
• bhyve: improve input validation in pci_xhci
• libnv: correct the calculation of the size of the structure
• ifnet: Remove if_getamcount()
• ifnet: Add handling for toggling IFF_ALLMULTI in ifhwioctl()
• ifconfig: Add an allmulti verb
• date: include old and new time in audit log
• bpf: Add IfAPI analogue for bpf_peers_present()
• pf: use AF_INET6 when comparing IPv6 addresses
• if_ovpn: ensure it is safe to modify the mbuf
• if_ovpn: declare our dependency on the crypto module
• pf: revert part of 39282ef3 to properly log the drop due to state limits
• pflog: pass the action to pflog directly
• various check removals for malloc(M_WAITOK) driver calls
• libpfctl: ensure we return useful error codes
• x86/ucode: add support for early loading of CPU ucode on AMD
• libfetch: improve optional CRL verification
• fetch: fix “–crl” option not working

ports

• curl 8.10.1
• dhcp6c 20241008
• dhcrelay 1.0
• dnspython 2.7.0
• expat 2.6.3
• hostapd 2.11
• kea 2.6.1
• libpfctl 0.13
• libxml 2.11.9
• monit 5.34.1
• nss 3.104
• openvpn 2.6.12
• phalcon 5.8.0
• php 8.2.24
• phpseclib 3.0.41
• pkg fix for for embedded libfetch when doing CRL verification
• py-duckdb 1.1.1
• python 3.11.10
• rrdtool 1.9.0
• sqlite 3.46.1
• sudo 1.9.16
• suricata 7.0.7
• syslog-ng 4.8.0
• unbound 1.21.1
• wpa_supplicant 2.11

A hotfix release was issued as 24.10_1:

• firmware: fix timeout in update CRL fetcher

A hotfix release was issued as 24.10_7:

• system: fix certificate condition in setCRL() (contributed by richierg)
• firewall: throttle live logging on dashboard widget
• mvc: fix config.xml file open mode in overwrite()
• mvc: add missing request->hasQuery()
• mvc: add missing request->getScheme()
• mvc: add missing request->getURI()

Migration notes, known issues and limitations

• The dashboard has been replaced. Widgets from the old format are no longer supported and need to be rewritten by the respective authors.
• ISC DHCP will no longer reload DNS services on static mapping edits. This is for feature parity with Kea DHCP and avoiding cross-service complications. If you expect your static mappings to show up in a particular DNS service please restart this service manually.

The public key for the 24.10 series is included.

SHA256 checksums for images included.

This business release is based on the OPNsense 24.4.2 business version with additional reliability improvements.

Here are the full patch notes:

• system: add snapshots (boot environments) support via MVC/API (contributed by Sheridan Computers)
• system: recover stuck monitors and offer a cron job
• isc-dhcp: allow to disable a DHCPv6 server with faulty settings
• openvpn: add close-on-exec flag to service lock file
• openvpn: add username field to the status page
• wireguard: add close-on-exec flag to service lock file
• mvc: improve container field cloning
• ui: allow style tag on headers
• ports: openssl 3.0.15

A hotfix release was issued as 24.4.3_1:

• firmware: add fingerprint, migration notes and upgrade hint for 24.10

This business release is based on the OPNsense 24.1.10 community version with additional reliability improvements.

Here are the full patch notes:

System

• system: add pluginctl -x/-X modes for digesting XMLRPC options
• system: replace rand() with random_int() in remote backup script
• system: skip tentative IPv6 addresses for binding in the web GUI (contributed by tionu)

Firewall

• firewall: migrate one-to-one NAT to MVC/API
• firewall: show inspect button on “xs” size screen

Interfaces

• interfaces: make SLAAC flush a feature of ifctl for incoming reuse
• interfaces: move SLAAC tunables to system requirements
• interfaces: disable IPv6 interface modes when IPv6 is disabled globally
• interfaces: avoid pluginctl giving out IPv4 info for non-interfaces
• interfaces: improve DHCPv6 requirement rules on WAN interface
• interfaces: support reading more attributes in ifconfig output parser
• interfaces: correct logic of resolve flag in ARP table (contributed by Kevin Pelzel)

Reporting

• reporting: add NetFlow IPv6 support for destinations

Dhcrelay

• dhcrelay: add logging into its own space

Firmware

• firmware: prefer ZFS over UFS in upgrade message
• firmware: remove unneeded Unbound DNS database upgrade script
• firmware: remove stale Squid plugin upgrade script

Isc-dhcp

• isc-dhcp: allow root domain input as “.” (contributed by Skyler Mantysaari)

Kea-dhcp

• kea-dhcp: support static DNS mappings (contributed by Markus Reiter)
• kea-dhcp: add description field to subnets
• kea-dhcp: add next-server option to subnets (contributed by Harm Kroon)
• kea-dhcp: fix privileges for page ACL

Openvpn

• openvpn: add “float” option to instances (contributed by Christian Kohlstedde)

Mvc

• mvc: refactored and improved checkAndThrowSafeDelete() as checkAndThrowValueInUse()

Ui

• ui: remove aria-hidden from dialogs (contributed by Jason Fayre)

Plugins

• plugins: os-OPNcentral 1.10
• plugins: os-OPNWAF 1.5
• plugins: os-bind 1.32
• plugins: os-caddy 1.6.0
• plugins: os-ddclient 1.22
• plugins: os-nginx 1.33
• plugins: os-theme-cicada 1.36 (contributed by Team Rebellion)
• plugins: os-theme-vicuna 1.46 (contributed by Team Rebellion)
• plugins: os-zabbix-agent 1.14
• plugins: os-zabbix-proxy 1.11

Ports

• ports: curl 8.8.0
• ports: dhcp6c 20240710 additions for WAN tracking, interface ID specification, etc.
• ports: openldap 2.6.8
• ports: php 8.2.20
• ports: py-duckdb 1.0.0
• ports: py-netaddr 1.3.0
• ports: sqlite 3.46.0

A hotfix release was issued as 24.4.2_1:

• firmware: add fingerprint, migration notes and upgrade hint for 24.10

This business release is based on the OPNsense 24.1.8 community version with additional reliability improvements.

Here are the full patch notes:

system

• fix maximum log file size being ignored when there is only one file
• make log rotate action available to Cron
• remove get_current_theme() and improve static page templating
• move radvd and rtsold to system log where they belong
• deny access to .core files from web GUI and disable core dumps by default
• move net.inet.icmp.drop_redirect sysctl to automatic mode
• add Google Drive configuration as an XMLRPC sync target
• do not create an interface route without an address

firewall

• use the new $.replaceInputWithSelector() for source/destination networks in MVC filter pages
• fix empty rule label rendered as “null” on sessions page

interfaces

• give DAD another second of delay to finish for the IPv6 renew
• reword the gateway selector default and help text to describe its function more accurately
• detect and ignore “detached” state for IPv6
• remove unused imports from sockstat list
• in SLAAC tracking prevent accepting our own radvd configuration

firmware

• change default fetch of changelog to 30 seconds
• dump TLS information for firmware server(s) in use

ipsec

• fix faulty “-” usage in URIs

kea-dhcp

• simplified the controller code
• generate JSON payload from model
• fix field separator for subnet domain search (contributed by KitKat31337)

isc-dhcp

• make private consumers actually private where it matters
• take into account that multiple ia-pd can be delegated

openvpn

• fix “attempt to read property…” in status page
• safeguard config access in updown_event.py

wireguard

• pass endpoint to validator to avoid invalid QR code errors on mobile app
• add MTU when set on the instance
• move validation to correct spot when no instance address and peer address was provided
• also validate hostnames correctly in peer generator endpoint

unbound

• change blocklist processing in _blocklist_reader()
• allow RFC 2181 compatible names in query forwarding

backend

• allow to query multiple sysctl queries at once
• resolve deprecation warnings for sre_constants (contributed by MaxXor)

mvc

• pass isFieldChanged() to children in ContainerField
• replace PhalconFilterValidationException with OPNsenseBaseValidationException wrapper
• extend model implementation to ease legacy migrations
• change exception handling in runMigrations() to avoid mismatches in attributes being silently ignored
• refactor grid search to fetch descriptive values from the model instead of trying to reconstruct them
• replace array_map+strval for loop with cast to preserve execution time in BaseListField
• silence spurious validation message when explicitly asked to ignore them

ui

• fix bootgrid parsing of timestamp
• improve tokenizer paste behaviour
• prevent vertical modal overflows and instead present a scrollbar
• add $.replaceInputWithSelector() action
• handle static page CSRF without Phalcon
• prevent word break for top level menu items

plugins

• os-OPNWAF 1.4
• os-acme-client 4.3
• os-caddy 1.5.6
• os-crowdsec 1.0.8
• os-freeradius 1.9.23
• os-frr 1.40
• os-relayd 2.9 moves validation to model where it belongs
• os-shadowsocks 1.1 adds transport mode option (contributed by xabbok255)
• os-squid workaround for broken OpenSSL legacy provider handling
• os-telegraf 1.12.11

src

• pfsync: fix use of invalidated stack variable
• pfsync: cope with multiple pending plus messages
• ipfw: skip to the start of the loop when following a keep-state rule
• bridge: use IF_MINMTU
• bridge: change MTU for new members
• ethernet: support ARP for 802 networks
• ethernet: fix logging of frame length
• debugnet: fix logging of frame length
• wg: use ENETUNREACH when transmitting to a non-existent peer
• fib_algo: lower level of algorithm switching messages to LOG_INFO
• libpfctl: fix incorrect pcounters array size
• pf: always mark states as unlinked before detaching them
• vxlan: add checking for loops and nesting of tunnels
• igc: increase default per-queue interrupt rate to 20000

ports

• hyperscan 5.4.2
• libpfctl 0.11
• libucl 0.9.2
• libxml 2.11.8
• lighttpd 1.4.76
• ntp 4.2.8p18
• openssl 3.0.14
• pecl-mcrypt 1.0.7
• phalcon 5.7.0
• php 8.2.19
• py-duckdb 0.10.3
• python 3.11.9
• strongswan 5.9.14
• suricata 7.0.5
• syslog-ng 4.7.1
• unbound 1.20.0

A hotfix release was issued as 24.4.1_2:

• wireguard: fix IP protocol detection for manual gateway
• ui: properly break out selectpicker options in modals
• ports: krb5 1.21.3
• ports: nss 3.101
• ports: openssh 9.8p1
• ports: openvpn 2.6.11
• ports: suricata 7.0.6

A hotfix release was issued as 24.4.1_3:

• firewall: fix regression in GeoIP aliases selector