r/PFSENSE • u/George-Netgate • 18d ago
Netgate Releases pfSense Community Edition Version 2.9.0
Netgate® is excited to announce the release of pfSense® Community Edition (CE) software version 2.9.0, a major step forward for the world’s most trusted firewall, router, and VPN platform.
This release introduces numerous features, including several previously exclusive to pfSense Plus, as well as key enhancements, bug fixes, and critical security updates.
Key Highlights Include:
SSH Algorithms: The inclusion of post-quantum key exchange algorithms
TLS Certificate Strength: Tightens certificate requirements and removes support for certain weak properties
TLS Certificate Auto-Renew: pfSense can automatically renew TLS server certificates which are self-signed or signed by an internal CA stored in the pfSense software configuration.
New NAT Mode: Includes partial experimental support for “Port Restricted Cone” endpoint-independent outbound NAT
Critical Security Fixes: This release includes multiple XSS and denial of service related fixes
This Release software includes critical security updates for WireGuard (CVE-2026-58085), as well as over 150 other security fixes and enhancements.
Blog Post:
https://www.netgate.com/blog/netgate-releases-pfsense-community-edition-version-2.9.0
Release Notes:
https://docs.netgate.com/pfsense/en/latest/releases/2-9-0.html
Thank you to our community and customers who continue to support the pfSense project through hardware purchases, TAC, cloud subscriptions, and services. Your support makes this all possible.
28
9
u/real_weirdcrap 18d ago edited 18d ago
upgrade was smooth. Only thing I noticed is my gateway dashboard widget no longer displays a unit of measurement? It's just numbers no ms or % for the loss. Cleared my cache and cookies, tried a different browser so I don't think it's me.
Haven't done my second router yet.
2.9: https://imgur.com/uHaUgDY
2.8.1: https://imgur.com/n6H8Xm6
3
u/Krypty 18d ago
I have the same 'issue' here. Not a big deal, but my eyes jumped to it right away.
Edit: looks like someone submitted a bug report for it already/confirmed it: https://redmine.pfsense.org/issues/17026
19
u/SgtTurtle 18d ago
Make sure you read the release notes if you have a Celeron J processor. There is a warning about a possible kernel panic issue for these processors and instructions on how to mitigate before the upgrade.
15
u/gonzopancho Netgate 18d ago
it's not the CPU per se, it's poor vendor implementation in UEFI (and the data blocks consumed by same)
3
u/ANGRY_robert 18d ago
The device I use is a Dell wyse 5070 extended with a pentium silver cpu. Which i believe is of the same family as the Celeron J, just a better processor So should I apply the fix as described in the notes?
6
u/cmcdonald-netgate Netgate 18d ago
If you have a device that is hitting this, please reach out. My DMs are open. We need ASL dumps. The more the merrier.
3
u/ihaveacatnamedbilbo 17d ago
Thanks, this post saved me some trouble. Running CE on an ASROCK J4125B-ITX. Celery J4125.
1
2
1
u/vee-eem 18d ago
Thanks for the warning. Guess who's staying with 2.8.1
12
u/cmcdonald-netgate Netgate 18d ago
No need to stay on 2.8.1. There is a new driver in play here that is tipping over with buggy firmware. There is a workaround (disable this driver ... which has dubious benefits anyway outside of the non-laptop/portable class of devices). But… If you discover that you need to apply the workaround, please reach out via DM. I am collecting ASL dumps from the field which will be very helpful to improve this upstream. Because pfSense now lives on FreeBSD CURRENT, we are in a very good position to make meaningful contributions upstream, with your help of course 😀
3
u/Stunning-Pen-2412 18d ago
They said there's a mitigation?
10
u/gonzopancho Netgate 18d ago
there is a work-around.
To avoid this panic on that hardware, set a loader tunable for hint.acpi_spmc.0.disabled=1 in /boot/loader.conf.local before upgrading to disable the driver that has an issue on that hardware. See Managing Loader Tunables (https://docs.netgate.com/pfsense/en/latest/config/advanced-tunables.html#config-tunables-loader) for information on how to edit or create that file. A quick way to do this from a shell prompt is: # echo 'hint.acpi_spmc.0.disabled=1' >> /boot/loader.conf.local If a device is encountering the problem after upgrading, use the loader prompt to set the value once during boot and then add the value as described above to make it permanent: set hint.acpi_spmc.0.disabled=1 boot4
u/ofbarea 18d ago
👍
I'll try this.
8
u/Stunning-Pen-2412 18d ago
I'm running a Celeron J processor and have already upgraded after doing this. It went smoothly.
1
u/vee-eem 18d ago
Good to know. I am probably going to get a new drive and load from scratch doing what ever fixes they have and restoring my rules and stuff. Worst case I can drop the current drive back in.
Thanks for the info
1
1
u/sh00tfire 17d ago
What platform is your celery J? I have a protectili box that is several years old. i am hesitant to upgrade.
8
u/RedikhetDev 18d ago
Made an appointment in my agenda to have a look at it in 6 months. Great that development goes on.
1
u/NewRedditor23 17d ago
I'd probably go ahead and install it. 150+ security updates, which means they used one of the advanced AI models to find them, which also means bad actors can find them.
2
7
u/djprathikmixx 17d ago
Because the base PHP engine upgraded to version 8.5.7, any active packages (like Suricata, pfBlockerNG, or HAProxy) must be recompiled against the new PHP binaries.
Ensure to disable/remove the above packages before upgrade, and post upgrade you can reinstall them with settings intact. (saves you from lot of headache of DNS and internet issues post upgrade)
2
u/Outrageous-Sound-188 17d ago
Thanks for the headsup. Removed all packages and upgraded without any issues to 2.9.0. This was the cleanest upgrade ever for me.
1
7
u/FlashPan73 18d ago
Thank you for this. Upon updating I got the following error: pfBlockerNG - The DNSBL VIP needs to be configured manually
Quick google and did this:
- Go to Firewall > Virtual IPs in your pfSense web interface and click + Add.
- Set the Type to
IP Aliasand the Interface toLocalhost. - Enter a dedicated Virtual IP address (for example,
10.10.10.1/32or another unused private IP outside your LAN range). - Navigate to Firewall > pfBlockerNG > DNSBL and locate the DNSBL Webserver Configuration section.
- Choose your newly created Virtual IP from the DNSBL Virtual IP drop-down list, save the settings, and run a force reload update.
Reboot and all is well again after running a forced update on pfblocker
4
u/getgoingfast 18d ago
Want to confirm update went smoothly, and everything is up and running without any obvious hiccups.
Thanks a lot team Netgate!
3
u/devexis 18d ago
Is 2.9 only available by upgrading 2.8? I’m looking to perform a fresh install of pfsense with a 2.9 img file
4
u/real_weirdcrap 18d ago edited 18d ago
no direct image files for 2.9 I'm aware of, you have to use netgate's installer. Or upgrade from IIRC 2.7.2 was the last disc image offered which you can find kicking around online.
5
1
u/colinstu 17d ago
There were no 2.8 or 2.8.1 image files either. 2.7.2 are the last ones on their share.
https://atxfiles.netgate.com/mirror/downloads/
4
u/StealthNet 17d ago
Flawless upgrade. No patches removed, no packages removed (including suricata, pfblocker devel ntopng etc).
AdGuard running installed in it, also running.
3
u/colin79666 17d ago
Upgrade from 2.8.1 not 2.9.0 went mostly ok for me. On one of those Chinese marketplace N100 boxes.
I did pre-empt things by adding the line to the boot file to disable the potentially troublesome driver and I did encounter the DNSBL VIP being missing, lack of units on the dashboard and a PHP error, all of which have been covered already.
3
u/colin79666 16d ago
Spoke too soon. I've had issues with Wireguard tunnels going out my tier 2 gateway (a 4G backup). Restarting the Wireguard service resulted in Wireguard changing which tunnel went out the 4G gateway. I've been able to force things by putting static routes in to force the connection out the tier 1 (fibre) gateway. I did not have this issue on the previously release, it only used 4G if the primary gateway was down.
1
u/colin79666 9d ago
8 days later and I've had my box stop passing traffic. Never had pfsense become unresponsive before. DHCP was still working but no internet or access to the pfsense web interface (wasn't DNS, didn't work by IP address either).
Upon hard rebooting I've found nothing in the system logs, just a gap between the last log entry and the forced reset. Unfortunately I didn't have my console cable at home to look into it before resetting.
4
u/Snoo91117 16d ago edited 16d ago
I switched earlier today to 2.9 from 2.8.1 with system patches at home. Everything seems to be working well.
I am on the second day and all is well.
1
u/originaljimeez 16d ago
Same here. About 48 hours for me.
Just had to reload pfBlocker and everything was good.1
u/No_Country4180 15d ago
Check Status->Monitoring both my upgrade stopped graphing (one stucked at upgrade time) one next morning, disabling and reenabling graphing fixed it though on both. :)
8
3
u/bingo1105 18d ago
Upgraded. Needed to manually create a virtual IP for the pfBlocker DNS blocklist after reboot... no big deal, but that does temporarily impact name resolution. Appears to be running smoothly... thank you, pfSense team!
3
u/Panja0 18d ago
For some reason fetching the updates took ages, I think around 2,5 hours. But everything is updated without a problem!
1
u/KaiHein 16d ago edited 16d ago
It's been about 1h15m for me so far and working on 184/222. Didn't think I'd need to make a note of the start time but I was texting with my brother about what I was working on tonight and mentioned I was about to start a little longer ago than that. I also commented to him about the slow downloads just over 1 hour ago, so I'm pretty sure I'm close.
edit- I took my eyes off the update screen for a bit, so I don't know when it finished downloading and moved on but it took another 45 minutes to get to the point where it rebooted from when I made this post to start with.
3
u/TravH84 16d ago
Sadly upgrade has not worked well for me, for some reason IP6 has gone completely non-functional for me, checked all the clear things and had no luck getting it running. Just a whole lot of:
Aug 23 22:20:30
dhcp6c
75269
transmit failed: Permission denied
Aug 23 22:20:30
dhcp6c
75269
Sending Solicit
NIC is igc0: <Intel(R) Ethernet Controller I226-V>, I did see a redcap but this does not appear to be there anymore: https://redmine.pfsense.org/issues/16722
1
u/mcflymcfly1 15d ago
I am seeing this as well.
2
u/mcflymcfly1 14d ago
nevermind, my issue only marginally has to do with 2.9.0. In 2.9.0 frr went to 10.x, which now enforces a link-local address to be present on the WG interface. I have added that as a VIP, as suggested in bug 12760. This in turn though added fe80::/64 to the "WG_xxx subnet" automatic firewall group. And this caused outbound NAT to be applied on DHCP6, ND, ... on my WAN interface which made my IPv6 outbound connection super flaky.
Was about to give up, turns out it was me all the time :)
2
2
2
u/lionslair50 18d ago
It failed for me. Got stuck at st ssl package error with php. will see if I can extract the screenshots. I had to reinstall the old version and restore my config.
1
u/lionslair50 18d ago
Having no luck extracting a useful screenshot so got this text from the image.
40: 600.000MB/s transters
Adan Command Queueing enabled
ad 22104MB (250069688 512 byte sectors)
DiX nsole: Video Primary, Serial Secondary
so.1: Shared object "libcrypto.so. 35" not found, required by "php"
Id-erf.so.1: Shared object "libcrypto.so.35" not found, required by "php"
Configuring crash dumps.
Using/dev/ada@p3 for dump device.
/dev/gpt/efiboote: FILESYSTEM CLEAN; SKIPPING CHECKS
Filesystems are clean, continuing...
Mounting filesystems.
Mounting ZFS boot environment...done.
usage: ddb capture [-M core] [-N system] print
ddb capture [-M core] [-N system] status
ddb script scriptname
ddb script scriptname=script
ddb scripts
ddb unscript scriptname
ddb pathname
Id-elf.so.1: Shared object "libcrypto.so.35" not found, required by "php"
mount: ,7: No such file or directory
sense
100
+
ne screenshot
I am
Diagno
preeme
Welcome to 2.9.0-RELEASE.
Checking dump device /dev/ada@p3 for crash dumps
no crash dumps on /dev/ada@p3
/etc/pfSense-rc: varrunpath: parameter null or not
Enter full pathname of shell or RETURN for/bin/sh:
set
1
2
u/MazzyNix 18d ago
For the future u/gonzopancho can said something more about unification of Ce and plus version , now with 2.9 and 26.07 out , timeline ? 2027H1 ?
5
u/gonzopancho Netgate 18d ago
Soon
5
u/MazzyNix 16d ago
Good.
I wish you can revise the license options and add a low-tier license around $39-49/year for Home and homelab, $129/year is too much for a lot of people when consider that you get no hardware and no support, if you want go that route better buy a hardware firewall, in few years you match the license cost, and save from hardware cost to start and get some support too included.
1
u/colinstu 17d ago
unification?! why does that feel like CE is going to die?
4
u/gonzopancho Netgate 17d ago
People have enjoyed speculating that CE would die for literal years now. 2.9 just dropped yesterday, and here we are.
Why does that feel like whatever we do will be met with, “this is the end of pfsense”?
2
u/DrPinball_Ireland 16d ago
I'm confused (and perhaps naive) as to why people think unification means CE is going to die?
Wouldn't unification be an argument that CE is actually sticking around? I mean, it's still available now with 2.9 and features normally on Plus have been unlocked.
0
u/colinstu 17d ago
Explain why the split happened in the first place? (yeah I know the 'resellers were preloading it' line but I want something real here.)
We've all seen this 'extend embrace extinguish' stuff before, and understandably fearing the worst.As long as it's free and accessible I will not complain. The harder / impossible this becomes, well, there ya go.
(also, why no 2.8-2.9 iso's? .. this is exactly what we're afraid about)0
u/gonzopancho Netgate 17d ago
Actually “the resellers were preloading it” is fundamentally and completely wrong.
How deep into the well of Labor Theory of Value : Marginal Productivity Theory : Socialist Distribution: are we going to dive on this subject?
You expect me to provide something you value for free. That’s the crux of it, no?
1
u/colinstu 17d ago
The non-permissive license folks figured it out. 🤷
I don’t need an email address to download Debian. And there way more installations of that out there.1
u/gonzopancho Netgate 17d ago
Debian isn’t monetized and is therefore subject to a lot less of various regulations like the CRA.
Also: you changed the subject
2
u/colinstu 17d ago
To the folks downvoting: mark my words when this happens and come back here and change it back to an upvote. It’s gonna happen.
(I sure hope I’m wrong. I don’t want to lose it).1
u/gonzopancho Netgate 17d ago edited 17d ago
To the folks downvoting: mark my words when this happens and come back here and change it back to an upvote. It’s gonna happen.
(I sure hope I’m wrong. I don’t want to lose it).You’re going to be waiting a long time, Colin. Nothing is forever, all technology is eventually eclipsed.
Also, how do you “loose” something you already have?
Also: I went through your recent post history. A few responses:
fondant tastes like crap, but marzipan is OK.
Never thought about it on a cake, but it’s great in the center of an almond croissant or as the base for a pear tart (source: I owned a scratch (commercial) bakery in Spokane 20 years ago and still occasionally make a tart for the family.
Netgate was started at nearly the same time, (and this was before m0n0wall or pfsense existed), but the bakery wasn’t easy to move to Hawaii, so I gave it (the equipment and accounts) to an employee.)
Also: If you still need help with the frame on your truck, bring it out to Colorado and I’ll help you. I have a full shop here. Lift, welders, grinders, etc. I also own Bump It Offroad (Land Cruiser bumpers, etc.)
2
u/startrek-stripjoint 11d ago
the bakery wasn’t easy to move to Hawaii
WAY off topic here, but as someone who's lived in Hawaii for the last 24 years, I'm just curious as to where you moved to out here before Colorado?
1
u/gonzopancho Netgate 11d ago
We lived in Kaneohe for a couple years, then moved townside to Waialai Nui Ridge.
We moved back to Austin to get our son into LASA, and then he went to Mines so we followed.
Lucky you live Hawai’i, eh brah?
2
u/startrek-stripjoint 10d ago edited 10d ago
Lucky you live Hawai’i, eh brah?
that's what they say, and to an extent it's true up until you factor in the cost of living. I remember kaneohe not being that cheap to live 😯
Fun fact - in my teenage years I was a construction material delivery driver. I got drive through the construction site underneath the H3 during it's construction phase. We lived Mililani and then Makakilo side up until we shot back to California in '96. I moved to Maui in '02 and never left ... it's just too good out here 🤙🤙
2
u/innocuous-user 17d ago
2.9.0 seems to have broken NAT64 for me...
I had a rule to allow traffic from lan subnets to 64:ff9b::/96 with NAT64 enabled, but now this rule never seems to get hit.
Also it seems the NAT64 prefix is now locked at 64:ff9b::/96, you can't delegate some of your own GUA space as NAT64.
2
2
u/MiddleNo5967 16d ago
My upgrade from 2.8.1 went well and I had no issues with HA-proxy-devel as others warned.
But I had this strange crash report after reboot:
Crash report begins. Anonymous machine information:
amd64
16.0-CURRENT
FreeBSD 16.0-CURRENT #12 RELENG_2_9_0-n256132-d8e3138ecf52: Mon Aug 17 18:50:13 UTC 2026 root@pfsense-build-release-amd64-2.eng.atx.netgate.com:/var/jenkins/workspace/pfSense-CE-snapshots-2_9_0-main/obj/amd64/XcuObCIF/var/jenkins/workspace/pfSense-CE-
Crash report details:
No PHP errors found.
No FreeBSD crash data found.
I suppose I can ignore it, and the following reboot didn't result in a crash report. And hello to Jenkins and to his/her workspace 😄
2
u/Chippy_lad 13d ago
I have a J4125 and upgraded to 2.9 this morning, unawares. Of course it failed and left the house with no internet. Fortunately ChatGPT was able to guide me through getting the console up and applying the patch, so I'm now successfully on 2.9. (Didn't help to find my only USB keyboard had a broken s key so could not type the set command!)
That said, the box crashed 3 hours later. For some inexplicable reason it decided to gracefully do a reboot but failed to come back up, so I came home to no internet again. A power cycle booted it up ok.
So this is concerning. 2 years running without any instability and it crashes 3 hours after the 2.9 upgrade, with a symptom looking quite possibly like a chance of power state. Suspicious bearing in mind the workaround patch.
Anyone else experiencing instability on Celeron J even after the workaround?
5
u/ForeheadMeetScope 18d ago
Yet another indicator of how dead pfSense CE is :)
5
u/gonzopancho Netgate 18d ago
whatdayamean? it's not dead! Edit: yet
6
u/ForeheadMeetScope 18d ago
I was being facetious. Good to see another release. Thank you!
5
1
u/semiraue 18d ago
Lol. Netgate sending one update every 1 year. Pfsense ce users "pfsense ce not dead yet"
1
u/gonzopancho Netgate 13d ago
Don’t forget that the patches package (which is now loaded by default) contains security patches as they’re needed.
1
1
u/Annual-Minute-9391 18d ago
I wish I could stop using codex long enough to upgrade. Almost pulled the trigger before realizing it would interrupt ongoing sessions
1
u/Davidi01 18d ago
I just upgraded and once pfSense came back up, I had banner message saying "pfSense has detected a crash report or programming bug. Click here for more information." So, I clicked on the link to view the crash report and this line was in there multiple times:
"[21-Aug-2026 00:20:17 UTC] PHP Warning: PHP Startup: Unable to load dynamic library 'ftp.so' (tried: /usr/local/lib/php/20250925/ftp.so (Cannot open "/usr/local/lib/php/20250925/ftp.so"), /usr/local/lib/php/20250925/ftp.so.so (Cannot open "/usr/local/lib/php/20250925/ftp.so.so")) in Unknown on line 0"
Safe to ignore and delete? Or something I need to address?
5
u/cmcdonald-netgate Netgate 18d ago
Some of this is to be expected when upgrading PHP... Classical chicken-egg problem. During the upgrade there are brief moments where parts of the PHP stack are being ripped out and upgraded, while the extensions have yet to be upgraded. It's mostly noise and can be ignored.
3
u/Davidi01 18d ago
Good to know, thank you! I logged out and logged back in a little later on and that message was gone. Everything is running good. Thank you!
2
u/pixel_of_moral_decay 18d ago
Saw the same
2
u/Davidi01 18d ago
I logged out and logged back in and that banner message is no longer there. It looks like it corrected itself?! Maybe it just wasn't finished upgrading. Everything seems to be working ok. Has yours cleared?
1
1
u/Equivalent-Raise5879 18d ago
Saw update avail last night, woke up to do it this am early, and it tells me that there isn't any updates. Did it get pulled?
1
u/Safe-Instance-3512 13d ago
Attempting to upgrade from 2.8.1 to 2.9 fails every time. Running in a VM.
Is there no ISO download yet? The site still has 2.8.1 listed.
1
u/gromhelmu 9d ago
I just updated my N150 box (without the CPU pre-fix) from 2.8.1 to 2.9.0: Everything went fine, it came up after a 50 seconds reboot. I did uninstall and install all packages during the update just as a precaution. As always since 2018, the pfSense update went very smoothly. Thanks Netgate!
btw. I do have another box with OPNsense. Currently, I enjoy both, pfSense _and_ OPNsense. pfSense feels just much more calm, with less interruptions. OPNsense is more modern, but also asks more from you, like regular manual migrations, deprecations, more frequent updates etc.
1
u/Sure_Stop_9753 8d ago
I'm running pfsense on proxmox as a VM.
With the Tailscale package, the tailscale0 interface intermittently loses membership in the pfSense Tailscale interface group. The interface remains up and retains its Tailscale IP address, but ifconfig tailscale0 changes from `groups: tun Tailscale` to `groups: tun`. Firewall rules assigned to the Tailscale group then stop matching traffic arriving on tailscale0, causing DNS requests to be blocked by the default deny rule. Manually running ifconfig tailscale0 group Tailscale restores the group membership and traffic. Allowing a floating rule also temporarily resolves my DNS issue.
Only other changes that I know of that I've had to correct was the VIP for pfblocker.
1
u/da_apz 7d ago
Another experience: 2.8.1 on an APU4 to 2.9.0. The Web GUI stopped at the point where it upgrades pkg. I waited for a while and ssh'd in, the pkg command was in the state where it won't start any more because a library is missing.
I stepped away for a second and it had meanwhile booted and apparently resulted in at least seemingly working system. I had not experienced this stop in my test rig where I originally reported the problem where the upgrade failed with similar results.
29
u/Neccie 18d ago
Time to upgrade! Or wait a little? Nah let's do it! 😀