Het pakket OPNsense is een firewall met uitgebreide mogelijkheden. Het is gebaseerd op het besturingssysteem FreeBSD en is oorspronkelijk een fork van m0n0wall en pfSense. Het pakket kan volledig via een webinterface worden ingesteld en heeft onder andere ondersteuning voor 2fa, openvpn, ipsec, carp en captive portal. Daarnaast kan het packetfiltering toepassen en beschikt het over een traffic shaper. De ontwikkelaars hebben met versienummer 23.7 de halfjaarlijkse grote update uitgebracht. De releasenotes voor die uitgave kunnen hieronder worden gevonden.
OPNsense 23.7 releasedFor more than 8 and a half years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.
23.7, nicknamed "Restless Roadrunner", features numerous MVC/API conversions including the new OpenVPN "instances" configuration option, OpenVPN group alias support, deferred authentication for OpenVPN, FreeBSD 13.2, PHP 8.2 plus much more.
Here are the full patch notes against 23.1.11:Migration notes, known issues and limitations:
- system: use parse_url() to validate if the provided login redirect string is actually parseable to prevent redirect
- system: fix assorted PHP 8.2 deprecation notes
- system: fix assorted permission-after-write problems
- system: introduce a gateway watcher service and fix issue with unhandled "loss" trigger when "delay" is also reported
- system: enabled web GUI compression (contributed by kulikov-a)
- system: disable PHP deprecation notes due to Phalcon emitting such messages breaking the API responses
- system: allow "." DNS search domain override
- system: on boot let template generation wait for configd socket for up to 10 seconds
- system: do not allow state modification on GET for power off and reboot actions
- system: better validation and escaping for cron commands
- system: better validation for logging user input
- system: improve configuration import when interfaces or console settings do not match
- system: name unknown tunables as "environment" as they could still be supported by e.g. the boot loader
- system: sanitize $act parameter in trust pages
- system: add severity filter in system log widget (contributed by kulikov-a)
- system: mute openssl errors pushed to stderr
- system: add opnsense-crypt utility to encrypt/decrypt a config.xml
- system: call opnsense-crypt from opnsense-import to deal with encrypted imports
- interfaces: extend/modify IPv6 primary address behaviour
- interfaces: fix bug with reported number of flapping LAGG ports (contributed by Neil Greatorex)
- interfaces: introduce a lock and DAD timer into newwanip for IPv6
- interfaces: rewrite LAGG pages via MVC/API
- interfaces: allow manual protocol selection for VLANs
- interfaces: remove null_service toggle as empty service name in PPPoE works fine
- interfaces: on forceful IPv6 reload do not lose the event handling
- interfaces: allow primary address function to emit device used
- firewall: move all automatic rules for interface connectivity to priority 1
- firewall: rewrote group handling using MVC/API
- firewall: clean up AliasField to use new getStaticChildren()
- firewall: "kill states in selection" button was hidden when selecting only a rule for state search
- firewall: cleanup port forward page and only show the associated filter rule for this entry
- captive portal: safeguard template overlay distribution
- dhcp: rewrote both IPv4 and IPv6 lease pages using MVC/API
- dhcp: allow underscores in DNS names from DHCP leases in Dnsmasq and Unbound watchers (contributed by bugfixin)
- dhcp: align router advertisements VIP code and exclude /128
- dhcp: allow "." for DNSSL in router advertisements
- dhcp: print interface identifier and underlying device in "found no suitable address" warnings
- firmware: opnsense-version: remove obsolete "-f" option stub
- firmware: properly escape crash reports shown
- firmware: fix a faulty JSON construction during partial upgrade check
- firmware: fetch bogons/changelogs from amd64 ABI only
- ipsec: add missing config section for HA sync
- ipsec: add RADIUS server selection for "Connections" when RADIUS is not defined in legacy tunnel configuration
- ipsec: only write /var/db/ipsecpinghosts if not empty
- ipsec: check IPsec config exists before use (contributed by agh1467)
- ipsec: fix RSA key pair generation with size other than 2048
- ipsec: deprecating tunnel configuration in favour of new connections GUI
- ipsec: clean up SPDField and VTIField types to use new getStaticChildren()
- ipsec: add passthrough networks when specified to prevent overlapping "connections" missing them
- monit: fix alert script includes
- openvpn: rewrote OpenVPN configuration as "Instances" using MVC/API available as a separate configuration option
- openvpn: rewrote client specific overrides using MVC/API
- unbound: rewrote general settings and ACL handling using MVC/API
- unbound: add forward-tcp-upstream in advanced settings
- unbound: move unbound-blocklists.conf to configuration location
- unbound: add database import/export functions for when DuckDB version changes on upgrades
- unbound: add cache-max-negative-ttl setting (contributed by hp197)
- unbound: fix upgrade migration when database is not enabled
- unbound: minor endpoint cleanups for DNS reporting page
- wizard: restrict to validating only IPv4 addresses
- backend: minor regression in deeper nested command structures in configd
- mvc: fill missing keys when sorting in searchRecordsetBase()
- mvc: properly support multi clause search phrases
- mvc: allow legacy services to hook into ApiMutableServiceController
- mvc: implement new Trust class usage in OpenVPN client export, captive portal and Syslog-ng
- mvc: add generic static record definition for ArrayField
- ui: introduce collapsible table headers for MVC forms
- plugins: os-acme-client 3.18
- plugins: os-bind 1.27
- plugins: os-dnscrypt-proxy 1.14
- plugins: os-dyndns removed due to unmaintained code base
- plugins: os-frr 1.34
- plugins: os-firewall 1.3 allows floating rules without interface set (contributed by Michael Muenz)
- plugins: os-telegraf 1.12.8
- plugins: os-zabbix62-agent removed due to Zabbix 6.2 EoL
- plugins: os-zabbix62-proxy removed due to Zabbix 6.2 EoL
- src: axgbe: enable RSF to prevent zero-length packets while in Netmap mode
- src: axgbe: only set CSUM_DONE when IFCAP_RXCSUM enabled
- src: ipsec: add PMTUD support
- src: FreeBSD 13.2-RELEASE
- ports: krb 1.21.1
- ports: nss 3.91
- ports: phalcon 5.2.3
- ports: php 8.2.8
- ports: py-duckdb 0.8.1
- ports: py-vici 5.9.11
- ports: sudo 1.9.14p3
- ports: suricata now enables Netmap V14 API
- The Unbound ACL now defaults to accept all traffic and no longer generates automatic entries. This was done to avoid connectivity issues on dynamic address setups -- especially with VPN interfaces. If this is undesirable you can set it to default to block instead and add your manual entries to pass.
- Dpinger no longer triggers alarms on its own as its mechanism is too simplistic for loss and delay detection as provided by apinger a long time ago. Delay and loss triggers have been fixed and logging was improved. The rc.syshook facility "monitor" still exists but is only provided for compatibility reasons with existing user scripts.
- IPsec "tunnel settings" GUI is now deprecated and manual migration to the "connections" GUI is recommended. An appropriate EoL announcement will be made next year.
- The new OpenVPN instances pages and API create an independent set of instances more closely following the upstream documentation of OpenVPN. Legacy client/server settings cannot be managed from the API and are not migrated, but will continue to work independently.
- The old DynDNS plugin was removed in favor of the newer MVC/API plugin for ddclient. We are aware of the EoL state of ddclient which was unfortunately announced only one year after we started working on the new plugin. We will try to add upstream fixes that have not been released yet and already offer our own ddclient-less Python backend in the same plugin as an alternative.
:fill(white):strip_exif()/i/2007222016.jpeg?f=thumbmedium)
/u/32287/crop5704f5348305b.png?f=community){kind=small}
:strip_exif()/u/117880/911_gt3rs_60.gif?f=community){kind=small}
:strip_icc():strip_exif()/u/157390/crop5decc9d996782_cropped.jpeg?f=community){kind=small}