OPNsense 25.1 Ultimate Unicorn veröffentlicht

Vor ein paar Wochen ist die Community Edition der Open-Source Firewall OPNSsense in Version 25.1 veröffentlicht worden. Diese Version erhielt den Namen „Ultimate Unicorn“ und markiert einen weiteren Meilenstein in der langen Entwicklungsgeschichte von OPNsense. Die neue Version erhielt zahlreiche Aktualisierungen und Neuerungen. Darunter einige in der MVC API, verbesserten Support für Sicherheitszonen , ZFS Snapshots Support, einen neuen Look in der UI mit dem light und dark Theme, sowie PHP 8.3 und FreeBSD 14.2 als Unterbau.

Download links, an installation guide[1] and the checksums for the images can be found below as well.

• Europe: https://opnsense.c0urier.net/releases/25.1/
• US East Coast: https://mirror.wdc1.us.leaseweb.net/opnsense/releases/25.1/
• US West Coast: https://mirror.sfo12.us.leaseweb.net/opnsense/releases/25.1/
• South America: http://mirror.ueb.edu.ec/opnsense/releases/25.1/
• East Asia: https://mirror.ntct.edu.tw/opnsense/releases/25.1/
• Full mirror list: https://opnsense.org/download/

Änderung gegenüber OPNsense Version 24.7.12:

• system: migrate user, group and privilege management to MVC/API
• system: remove the „disable integrated authentication“ feature
• system: add „Default groups“ option to add standard groups when a LDAP/RADIUS user logs in
• system: remove the old manual LDAP importer
• system: migrate HA status page to MVC/API
• system: allow custom additions to sshd_config (contributed by Neil Greatorex)
• system: increase max-request-field-size for web GUI
• system: set tunable default for checksum offloading of the vtnet(4) driver to disabled (contributed by Patrick M. Hausen)
• system: add support for RFC 5549 routes and refactor static route creation code
• system: improve notification support to also allow persistent notifications and static banners
• system: add notifications for low disk space and OpenSSH file override use
• system: migrate tunables page to MVC/API
• system: switch to temperature sensor caching
• system: add certificate widget to track expiration dates and allow quick renewal
• system: remove deprecated „page-getserviceprovider“, „page-dashboard-all“ and „page-system-groupmanager-addprivs“ privileges
• system: replace file_get_contents() with curl implementation in XMLRPC sync and add verifypeer option
• system: add item edit links to several dashboard widgets
• system: prioritize index page and prevent redirection to a /api page on login
• system: mute disk space status in case of live install media
• system: optimize system status collection
• interfaces: adhere to DAD during VIP recreation in rc.newwanipv6
• interfaces: remove non-functional features from bridges
• interfaces: remove PPP edit in interfaces settings
• interfaces: batched device type creation under „devices“ submenu
• interfaces: move PPP and wireless logs to system log
• interfaces: remove „Use IPv4 connectivity“ setting as it will be set by default
• firewall: use „skip lo0“ instead of policing lo0 explicitly following OpenBSD best practice
• firewall: remove duplicate table definition and make sure bogonsv6 table always exists
• firewall: cleanup of CARP and IPv6 rules behaviour
• firewall: filter feature parity in automation rules
• firewall: offer multi-select on source and destination addresses
• firewall: add experimental inline shaper support to filter rules
• firewall: add missing columns on one-to-one NAT page
• firewall: fix unassociated rule creation
• firewall: fix anti-lockout and „allow access to DHCP failover“ automatic rules
• firewall: add optional authorization for URL type aliases
• firewall: add „URL Table in JSON format (IPs)“ alias type
• dnsmasq: update ICANN Trust Anchor (contributed by Loganaden Velvindron)
• firmware: fix „r“ abbreviation vs. version_compare();
• installer: fixed missing prompt and help text in ZFS disk selection
• installer: warn on low RAM for ZFS as well
• installer: added a power off option
• intrusion detection: policy content dropdown missing data-container
• intrusion detection: cleanse metadata for brackets
• ipsec: add log search button in sessions
• ipsec: add banner message when using custom configuration files
• kea-dhcp: add „match-client-id“ in subnet definitions
• lang: update available translations
• monit: wrap exec in double quotes to allow arguments (contributed by Nikita Uvarov)
• monit: flag file overwrites when they exist
• network time: take IPv6 addresses into account
• network time: remove support for explicit VIP selection
• openvpn: add validation pertaining to auth-gen-token and reneg-sec combinations
• unbound: cleanup available blocklists and add hagezi blocklists
• unbound: fix root.hits permission on copy
• unbound: flag file overwrites when they exist
• backend: -m option is unused so remove its complication
• mvc: implement reusable grid template using form definitions
• mvc: add Default() method to reset a model to its factory defaults
• mvc: fix LegacyMapper when the mount point is not the XML root
• mvc: move explicit cast in BaseModel when calling field->setValue()
• mvc: fields should implement getCurrentValue() rather than __toString()
• mvc: fix value lookup in LinkAddressField
• mvc: memory preservation fix in BaseListField
• mvc: support lazy loading on alias models and use it in NetworkAliasField
• mvc: fix NetworkValidator for IPv4-mapped addresses with netmask (contributed by John Fieber)
• ui: upgrade Font Awesome icons to version 6
• ui: push search/edit logic towards bootgrid implementation
• ui: improved links with automatic edit and/or search
• ui: rewritten default theme for a light look and new logo
• ui: added default theme variant with a dark look
• plugins: turning binary data into JSON may fail globally
• plugins: os-acme-client 4.8[2]
• plugins: os-caddy 1.8.1[3]
• plugins: os-cpu-microcode 1.1 removes unneeded late loading code
• plugins: os-haproxy 4.5[4]
• pluginsL os-tailscale 1.2[5]
• src: FreeBSD 14.2-RELEASE[6]
• src: p9fs: add an implementation of the 9P filesystem
• ports: lighttpd 1.4.77[7]
• ports: openvpn 2.6.13[8]
• ports: php 8.3.15[9]
• ports: radvd 2.20[10]

Migration notes, known issues and limitations:

The access management was rewritten in MVC and contains behavioural changes including not rendering UNIX accounts for non-shell users. The integrated authentication via PAM has been the default for a long time so the option to disable it has been removed. The manual LDAP importer is no longer available since LDAP/RADIUS authenticators support on-demand creation and default group setup option. The „page-system-groupmanager-addprivs“ privilege was removed since the page does not exist anymore. A multi-purpose privilege editor has been added under the existing „page-system-usermanager-addprivs“ instead.

PPP devices can no longer be configured on the interface settings page. To edit the device settings use the native PPP device edit page instead.

FreeBSD 14.2 comes with the stock pf(4) behaviour regarding ICMPv6 neighbour discovery state tracking which was avoided so far in 24.7.x.

Let’s Encrypt ends support for the OCSP Must Staple extension on 30.01.2025. Issuance requests will fail if this option is still enabled past this date.