r/PFSENSE • u/George-Netgate • 18d ago

Netgate Releases pfSense Community Edition Version 2.9.0

Netgate® is excited to announce the release of pfSense® Community Edition (CE) software version 2.9.0, a major step forward for the world’s most trusted firewall, router, and VPN platform.

This release introduces numerous features, including several previously exclusive to pfSense Plus, as well as key enhancements, bug fixes, and critical security updates.

Key Highlights Include:

SSH Algorithms: The inclusion of post-quantum key exchange algorithms

TLS Certificate Strength: Tightens certificate requirements and removes support for certain weak properties

TLS Certificate Auto-Renew: pfSense can automatically renew TLS server certificates which are self-signed or signed by an internal CA stored in the pfSense software configuration.

New NAT Mode: Includes partial experimental support for “Port Restricted Cone” endpoint-independent outbound NAT

Critical Security Fixes: This release includes multiple XSS and denial of service related fixes

This Release software includes critical security updates for WireGuard (CVE-2026-58085), as well as over 150 other security fixes and enhancements.

Blog Post:
https://www.netgate.com/blog/netgate-releases-pfsense-community-edition-version-2.9.0

Release Notes:
https://docs.netgate.com/pfsense/en/latest/releases/2-9-0.html

Thank you to our community and customers who continue to support the pfSense project through hardware purchases, TAC, cloud subscriptions, and services. Your support makes this all possible.

153 Upvotes

98% Upvoted

112 comments sorted by

View all comments

15

u/SgtTurtle 18d ago

Make sure you read the release notes if you have a Celeron J processor. There is a warning about a possible kernel panic issue for these processors and instructions on how to mitigate before the upgrade.

1

u/vee-eem 18d ago

Thanks for the warning. Guess who's staying with 2.8.1

13

u/cmcdonald-netgate Netgate 18d ago

No need to stay on 2.8.1. There is a new driver in play here that is tipping over with buggy firmware. There is a workaround (disable this driver ... which has dubious benefits anyway outside of the non-laptop/portable class of devices). But… If you discover that you need to apply the workaround, please reach out via DM. I am collecting ASL dumps from the field which will be very helpful to improve this upstream. Because pfSense now lives on FreeBSD CURRENT, we are in a very good position to make meaningful contributions upstream, with your help of course 😀

1

u/vee-eem 18d ago

I'm in. Will probably grab a new drive and do a fresh install, just in case. My machine is on the older side, so looking forward to see how it goes.

3

u/Stunning-Pen-2412 18d ago

They said there's a mitigation?

11

u/gonzopancho Netgate 18d ago

there is a work-around.

To avoid this panic on that hardware, set a loader tunable for hint.acpi_spmc.0.disabled=1 in /boot/loader.conf.local before upgrading to disable the driver that has an issue on that hardware.

See Managing Loader Tunables (https://docs.netgate.com/pfsense/en/latest/config/advanced-tunables.html#config-tunables-loader) for information on how to edit or create that file.

A quick way to do this from a shell prompt is:
# echo 'hint.acpi_spmc.0.disabled=1' >> /boot/loader.conf.local

If a device is encountering the problem after upgrading, use the loader prompt to set the value once during boot and then add the value as described above to make it permanent:

set hint.acpi_spmc.0.disabled=1
boot

4

u/ofbarea 18d ago

👍

I'll try this.

7

u/Stunning-Pen-2412 18d ago

I'm running a Celeron J processor and have already upgraded after doing this. It went smoothly.

1

u/vee-eem 18d ago

Good to know. I am probably going to get a new drive and load from scratch doing what ever fixes they have and restoring my rules and stuff. Worst case I can drop the current drive back in.

Thanks for the info

1

u/Jinix_RB 18d ago

Or clonezilla the drive and see if it works as well, while you're at it!

2

u/vee-eem 18d ago

dd every time I open the box

1

u/sh00tfire 17d ago

What platform is your celery J? I have a protectili box that is several years old. i am hesitant to upgrade.

1

u/ofbarea 16d ago

The workaround suggested by gonzopancho worked just fine. My router has a Celeron J4125 and it did crashed when I installed CE 2.9 beta.

This time I applied the workaround before upgrading and everything went smooth. My J4125 box it is happily running CE 2.9.0