mirror of https://github.com/opnsense/docs
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1362 lines
66 KiB
ReStructuredText
1362 lines
66 KiB
ReStructuredText
===========================================================================================
|
|
15.1 "Ascending Albatross" Series
|
|
===========================================================================================
|
|
|
|
|
|
The OPNsense core team is proud to announce that it has released its 15.1
|
|
version, nicknamed "Ascending Albatross", of the open source OPNsense
|
|
firewall software.
|
|
|
|
This is the first release by the OPNsense project. Download `[1] <http://opnsense.org/download/>`__ and try it now!
|
|
Be sure to visit the project website `[2] <http://www.opnsense.org/>`__ and learn more about us and the
|
|
project. The project wants to be a friendly place for users, developers and
|
|
partners.
|
|
|
|
We believe that an open source project should keep its sources and build tools
|
|
available for all. OPNsense uses the simple 2-clause BSD license.
|
|
|
|
Users benefit from the polished installer, rich feature set and modern user
|
|
interface. Developers are invited to check out our easy-to-use build tools.
|
|
Commercial Support assists in keeping networks fast and secure. The project
|
|
welcomes partners to be successful together.
|
|
|
|
OPNsense(r) is based on FreeBSD 10 and is a fork of pfSense(r) which in its
|
|
turn is a fork of m0n0wall(r).
|
|
|
|
The next major release is 15.7 and is to be released on July 1st 2015. Bug
|
|
fixes and security patches will be released when available.
|
|
|
|
We are looking forward to welcome you in the OPNsense community.
|
|
|
|
Because Open makes Sense!
|
|
|
|
The OPNsense core team
|
|
|
|
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.12 (June 17, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
It's sad but true: 15.1.12 may very well be the last of its kind. 6 months
|
|
are almost over and 15.7 is around the corner with a number of changes e.g.
|
|
how we do version numbers, release engineering branches and upcoming versions
|
|
such as 16.1. As nothing is set in stone, we ask you to participate in the
|
|
discussion on the forums:
|
|
|
|
https://forum.opnsense.org/index.php?topic=705.0
|
|
|
|
The aftermath of the recent OpenSSL release(s) finally settled so now we are
|
|
shipping FreeBSD's security advisory along with the latest releases of
|
|
OpenSSL 1.0.2c and LibreSSL 2.2.0. Upgrading PHP 5.6.10 seemed like another
|
|
sensible thing to do.
|
|
|
|
The firmware update side of things received another minor batch of changes
|
|
and is now at a point we're satisfied with. Should you find anything odd
|
|
or unusual, please let us know.
|
|
|
|
Here is the full list of changes:
|
|
|
|
* src: fix OpenSSL multiple vulnerabilities `[1] <https://www.freebsd.org/security/advisories/FreeBSD-SA-15:10.openssl.asc>`__
|
|
* src: update base system file(1) to 5.22 `[2] <https://www.freebsd.org/security/advisories/FreeBSD-EN-15:07.zfs.asc>`__
|
|
* src: improve reliability of ZFS `[3] <https://www.freebsd.org/security/advisories/FreeBSD-EN-15:06.file.asc>`__
|
|
* src: updated to tzdata2015e `[4] <http://mm.icann.org/pipermail/tz-announce/2015-June/000032.html>`__
|
|
* ports: openssl 1.0.2c `[5] <https://www.openssl.org/news/openssl-1.0.2-notes.html>`__ , libressl 2.2.0 `[6] <http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.2.0-relnotes.txt>`__ , php 5.6.10 `[7] <https://php.net/ChangeLog-5.php#5.6.10>`__ ,
|
|
dnsmasq 2.73 `[8] <https://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__ , smartmontools 6.4 `[9] <https://www.smartmontools.org/browser/tags/RELEASE_6_4/smartmontools/NEWS>`__
|
|
* syslogd: disable unmaintained and unused ZMQ patches
|
|
* opnsense-update: gained independent awareness of kernel and
|
|
base system version
|
|
* opnsense-update: improved the manual page to include all recent changes
|
|
* firmware: bring back /etc/shells support to avoid the unknown shell
|
|
warning on bootup
|
|
* firmware: always schedule next poll while upgrade is running to
|
|
accommodate for web server restart delay
|
|
* logs: fix DHCP reverse ordering and update layout
|
|
* wizard: remove false statement about using "dhcp" for LAN setup
|
|
* menu: order interfaces by name
|
|
* captive portal: fix database creation query by avoiding SQL injection
|
|
syntax that broke due to a recent upstream hardening of the database
|
|
adapter underneath
|
|
|
|
The images can be obtained via any of our mirrors, given a bit of delay
|
|
for them to pull in the latest images:
|
|
|
|
https://opnsense.org/download/
|
|
|
|
The checksums are:
|
|
|
|
.. code-block::
|
|
|
|
# SHA256 (OPNsense-15.1.12_OpenSSL-cdrom-amd64.iso.bz2) = 60664c127e0f35f7ca9150ca31ef56de89b217f34f45959957ddd279d8512007
|
|
# SHA256 (OPNsense-15.1.12_OpenSSL-nano-amd64.img.bz2) = 044b144fd892bebb1499a9788e37f43a92ffa2c175b07fc49ea24f3cb21032b7
|
|
# SHA256 (OPNsense-15.1.12_OpenSSL-serial-amd64.img.bz2) = 8b450c6aff84cc9bfb7bcae72a50975d965872415f12a04226ef6688c074a3ef
|
|
# SHA256 (OPNsense-15.1.12_OpenSSL-vga-amd64.img.bz2) = 6c0d7529ce77b387ab97fc6557987ac68256a2e5cb6e5993ba807be91a08cd45
|
|
# SHA256 (OPNsense-15.1.12_OpenSSL-cdrom-i386.iso.bz2) = 95a31bb2d854cb8370b58e95155fae34b824393e1add53a99349e7452e4c7313
|
|
# SHA256 (OPNsense-15.1.12_OpenSSL-nano-i386.img.bz2) = 9d86a0ecdf74b28b627672f19fd652c6792e884dda68effe680c495934926e6d
|
|
# SHA256 (OPNsense-15.1.12_OpenSSL-serial-i386.img.bz2) = a6b6460b9cb398993f9507c77644fc6ab13ad65786ed33c4bdd16a2d93d58606
|
|
# SHA256 (OPNsense-15.1.12_OpenSSL-vga-i386.img.bz2) = aecf58f9f77cf1f4f712bc8deb0ac987b0f060c7f4e9f7163d5767d1c2fbc105
|
|
|
|
.. code-block::
|
|
|
|
# MD5 (OPNsense-15.1.12_OpenSSL-cdrom-amd64.iso.bz2) = f7701aa70024bbab8395f808d9695eb0
|
|
# MD5 (OPNsense-15.1.12_OpenSSL-nano-amd64.img.bz2) = 2e32ea342755513f87b13db4900cd1b8
|
|
# MD5 (OPNsense-15.1.12_OpenSSL-serial-amd64.img.bz2) = 7722c2de2d06b56a32d32f49b28007d6
|
|
# MD5 (OPNsense-15.1.12_OpenSSL-vga-amd64.img.bz2) = d2ad9fc3bad8bff348d60f6a879122e6
|
|
# MD5 (OPNsense-15.1.12_OpenSSL-cdrom-i386.iso.bz2) = acefe5ce4cefe49e6c601db602af95b2
|
|
# MD5 (OPNsense-15.1.12_OpenSSL-nano-i386.img.bz2) = 5f2f3c2c76996284557b2e8e4f9cadf2
|
|
# MD5 (OPNsense-15.1.12_OpenSSL-serial-i386.img.bz2) = 6b0745526824badc05c53fee6c5b035c
|
|
# MD5 (OPNsense-15.1.12_OpenSSL-vga-i386.img.bz2) = f1c67cac62d621a289dfb8c7384a242f
|
|
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.11.4 (June 12, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
Coincidentally, we scheduled 15.1.11.4 for today and have found ourselves in
|
|
the middle of an OpenSSL/LibreSSL update. FreeBSD has been really quick and
|
|
provided ports updates for both of them. OpenSSL base updates, however,
|
|
won't be shipped today. That isn't so bad, because we build all ports against
|
|
the newer version by default. The base update will follow next week.
|
|
|
|
There have been quite a few things happening apart from \*SSL, see the notes
|
|
and links to individual updates. Another round of stabilisation for the
|
|
firmware GUI will make upgrading a bit more consistent in the future. And,
|
|
ironically, if you encounter the update freezing up in the GUI, simply
|
|
refresh the page and look for new updates.
|
|
|
|
Here is the full list of changes:
|
|
|
|
* notable ports updates: pcre 8.37_1 `[1] <https://github.com/freebsd/freebsd-ports/commit/030adcf1d>`__ , phalcon 2.0.2 `[2] <https://github.com/phalcon/cphalcon/releases>`__ ,
|
|
strongswan 5.3.2 `[3] <https://wiki.strongswan.org/projects/strongswan/wiki/Changelog53>`__ , sqlite 3.8.10.2 `[4] <https://sqlite.org/releaselog/3_8_10_2.html>`__
|
|
* more notable ports: openvpn 2.3.7 `[5] <https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.7>`__ , openssl 1.0.2b `[6] <http://marc.info/?l=openbsd-announce&m=143404058913441>`__ ,
|
|
libressl 2.1.7 `[7] <https://github.com/freebsd/freebsd-ports/commit/40365ab880101ee>`__ , pkg 1.5.4 `[8] <https://www.openssl.org/news/secadv_20150611.txt>`__
|
|
* opnsense-update: has gained the ability to do package updates as well
|
|
* core: removed unused ssh_tunnel_shell and 3gstats utilities, added sudo
|
|
to the default utilities
|
|
* captiveportal/traffic shaper: better fix for localhost skip
|
|
* traffic shaper: added ICMP, IGMP, ESP, AH and GRE protocols to
|
|
selectable protocols
|
|
* core: fixed a bug that prevented our API from working properly with
|
|
Phalcon 2.0.1 and above
|
|
* backend: added configctl command utility launcher and improved its
|
|
logging capabilities
|
|
* backend: worked around a performance degradation bug in Python 2.7
|
|
on FreeBSD
|
|
* gateways: monitoring via :code:`apinger` is now turned off by default for
|
|
all new gateways created (opt-out flipped to opt-in for privacy reasons)
|
|
* firmware: refactored firmware code to use opnsense-update's new capabilities
|
|
* firmware: fix parsing of packages to be upgraded in fringe cases
|
|
* firmware: fix overzealous caching of available package upgrades
|
|
* users: user with group admins now have :code:`wheel` group associated with them,
|
|
allowing them to use :code:`su` or :code:`sudo` (if configured)
|
|
* users: do not copy root's hidden files while creating a new user
|
|
home directory
|
|
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.11.3 (June 05, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
A tiny batch of fixes comes bundled with today's 15.1.11.3 mainly to
|
|
increase stability during WiFi USB attach/detach. It is a work in
|
|
progress so please let us know how your experience changes.
|
|
|
|
Here are the full patch notes:
|
|
|
|
* config: improved the deletion of backups
|
|
* wifi: do not launch FreeBSD's rc scripts on 802.11 attach/detach
|
|
* ipfw: always forward traffic coming from localhost
|
|
* system: apply PSR2 coding style to GUI pages
|
|
* captive portal: apply PSR2 coding style to GUI pages
|
|
|
|
|
|
Stay safe,
|
|
Your OPNsense team
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.11.2 (June 03, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
Today's update includes a shiny new rewrite of the traffic shaper
|
|
functionality for dummynet, another completed chapter in the ongoing
|
|
quest for standardisation towards FreeBSD. The other gem is the first
|
|
batch of translations for Simplified Chinese kindly provided by two of
|
|
our enthusiastic users from China. We ask for you to try both features
|
|
and let us know about limitations and issues through any of the usual
|
|
channels. We appreciate likes and don't-likes alike. :)
|
|
|
|
Security-wise, it has been rather quiet. Enjoy it while it lasts. Here
|
|
are the full patch notes:
|
|
|
|
* notable ports upgrades: pcre 8.37, pkg 1.5.3, ca_root_nss 3.19.1
|
|
* aliases: fix javascript error that prevented aliases from woking
|
|
* traffic shaper: rewrote the feature using standard components on top
|
|
of the new MVC framework/API (see Firewall: Traffic Shaper)
|
|
* system: enabled first few hundred translations of Simplified Chinese
|
|
to help the community to progress and review said translation
|
|
(see System: Settings: General)
|
|
* vpn: all GUI files underwent a thorough coding style refresh
|
|
* firmware: prevent spurious "Module already loaded" errors while
|
|
upgrading PHP packages
|
|
|
|
The packages for OpenSSL and LibreSSL are up and can be applied via the
|
|
GUI or console firmware upgrade.
|
|
|
|
|
|
Stay safe,
|
|
Your OPNsense team
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.11.1 (May 23, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
Today it's time for 15.1.11.1 which includes two tweaks for the recent
|
|
Logjam vulnerability as well as the images for OPNsense on top of OpenSSL.
|
|
The reason for not providing LibreSSL images is that we are going to make
|
|
the flavour selectable via the GUI since pkgng does such a great job of
|
|
tracking and resolving all the provided and required dependencies.
|
|
|
|
* crypto: regenerate DH parameters for 1024, 2048 and 4096 bit
|
|
* crypto: tweak the web server config to harden against Logjam
|
|
|
|
Firmware upgrades for LibreSSL and OpenSSL are live. The OpenSSL images
|
|
can be found here:
|
|
|
|
https://opnsense.org/download/
|
|
|
|
The checksums are as follows:
|
|
|
|
.. code-block::
|
|
|
|
# SHA256 (OPNsense-15.1.11.1_OpenSSL-cdrom-amd64.iso.bz2) = 280f02a2da3ff9e9ad1f655a8661c845765493f36e1788b8c852af9886c50316
|
|
# SHA256 (OPNsense-15.1.11.1_OpenSSL-nano-amd64.img.bz2) = 2d14d881311ca8b188a41a2d57aee6e0bec66f55066f2844502d4ef17e64935e
|
|
# SHA256 (OPNsense-15.1.11.1_OpenSSL-serial-amd64.img.bz2) = e6e3c8c425dfebc33df9d66cc013616898963c72c52df6e0bed388126c2143a1
|
|
# SHA256 (OPNsense-15.1.11.1_OpenSSL-vga-amd64.img.bz2) = 64de0201f37cf75c3ba5084f06a1f545eb0a9c4e8248354b584a024322edf488
|
|
# SHA256 (OPNsense-15.1.11.1_OpenSSL-cdrom-i386.iso.bz2) = 18f1b40981d243173c524af208f8c4cf10a46d41f676d350baba477f07c2ff9e
|
|
# SHA256 (OPNsense-15.1.11.1_OpenSSL-nano-i386.img.bz2) = 2160335ab904fb0f82dc2629ea7c9116c36059928860169bb9eeac87038db5c7
|
|
# SHA256 (OPNsense-15.1.11.1_OpenSSL-serial-i386.img.bz2) = a2f7ce128a1ea3ab4942e7ff5accb2901110324d73c516b7bd1a7947b70697cf
|
|
# SHA256 (OPNsense-15.1.11.1_OpenSSL-vga-i386.img.bz2) = df112aca62de658518bc3f904336fb9024daf404741880e9bb7b93912a5b2af3
|
|
|
|
.. code-block::
|
|
|
|
# MD5 (OPNsense-15.1.11.1_OpenSSL-cdrom-amd64.iso.bz2) = edc4349b7f3b815302724e60c7ddc0cb
|
|
# MD5 (OPNsense-15.1.11.1_OpenSSL-nano-amd64.img.bz2) = 1f2cca409ba7e1ab91d6e937627ac275
|
|
# MD5 (OPNsense-15.1.11.1_OpenSSL-serial-amd64.img.bz2) = 3dcb482fa561fb46748d18fb07048553
|
|
# MD5 (OPNsense-15.1.11.1_OpenSSL-vga-amd64.img.bz2) = e56074166925c14b586dfff68c8d4494
|
|
# MD5 (OPNsense-15.1.11.1_OpenSSL-cdrom-i386.iso.bz2) = 3b1904072a4ea48aad6a70cde451cade
|
|
# MD5 (OPNsense-15.1.11.1_OpenSSL-nano-i386.img.bz2) = a040f331af20a5025d5cbcea1e57d348
|
|
# MD5 (OPNsense-15.1.11.1_OpenSSL-serial-i386.img.bz2) = 0a8f26ff6fab41c699ba03a9805ec6b5
|
|
# MD5 (OPNsense-15.1.11.1_OpenSSL-vga-i386.img.bz2) = cf7b4e86a0a856499ca843524d0824bc
|
|
|
|
Info on how to obtain LibreSSL-based images which are then easily upgraded
|
|
to 15.1.11.1 can be found here:
|
|
|
|
https://forum.opnsense.org/index.php?topic=78.0
|
|
|
|
|
|
Stay safe,
|
|
Your OPNsense team
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.11 (May 22, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
As we are nearing the finish line for version 15.7 in July, we sat down on
|
|
a single table in the Netherlands this week to review the changes that we've
|
|
made over the past 5 months and we saw that only one road map `[1] <https://opnsense.org/about/road-map/>`__ item is
|
|
still open: the frequently requested IDS package! We've come a long way
|
|
since the initial 15.1 and have seen stability increase, functionality
|
|
expand and timely updates being sustained on an almost weekly basis.
|
|
Certainly achievements we want to keep whilst going forward.
|
|
|
|
The initial release of 15.1.11 has been postponed since Tuesday due to a
|
|
framework update we've had to exclude as well as polishing the new GUI
|
|
firmware feature to finally revive the base system update. If you are
|
|
updating from the GUI to this release, you will still have to run the
|
|
Console Firmware (Option 12) upgrade to bring your base system up to date
|
|
(FreeBSD 10.1-RELEASE-p10). This is the last time, we promise. A reboot
|
|
is mandatory.
|
|
|
|
We ship PHP 5.6.9 ahead of FreeBSD, removed numerous unused packages and
|
|
two more custom kernel patches bringing us down to 5 custom patches from
|
|
previously more than 40. We also have plans for further pruning, probably
|
|
running without custom patches when FreeBSD 10.2 hits the shelves,
|
|
metaphorically speaking.
|
|
|
|
We haven't forgotten the recent Logjam Attack `[2] <https://weakdh.org/>`__ , but wanted not to postpone
|
|
the current release any further. With that being said, 15.1.11.1 is coming
|
|
out tomorrow including wary tweaks related to Logjam.
|
|
|
|
Here is the full list of changes for 15.1.11:
|
|
|
|
* core: removed unused package dependencies b42-fwcutter, bwi-firmware-kmod,
|
|
dmidecode, ifstated, pecl-ssh2
|
|
* core: switched back from bind-tools to the latest full bind 9.10 package
|
|
due to various requests
|
|
* src: fix panic in pf(4) in conjunction with ALTQ `[3] <https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=200222>`__
|
|
* src: updated to FreeBSD 10.0-RELEASE-p10 `[4] <https://www.freebsd.org/security/advisories/FreeBSD-EN-15:04.freebsd-update.asc>`__ `[5] <https://www.freebsd.org/security/advisories/FreeBSD-EN-15:05.ufs.asc>`__
|
|
* src: reverted two more custom patches to align with FreeBSD
|
|
* ports: updated to ca_root_nss 3.19, sqlite 3.8.10.1, php 5.6.9 `[6] <https://php.net/ChangeLog-5.php#5.6.9>`__ ,
|
|
openssh-portable 6.8p1_7 `[7] <http://www.openwall.com/lists/oss-security/2015/05/16/3>`__
|
|
* opnsense-update: exclude /etc/tty from the upgrade
|
|
* bsdinstaller: reworked the internals to align to modern port standards
|
|
* captive portal: switched rules generation to new template engine
|
|
* firmware: reimplement the GUI firmware update using MVC code
|
|
* menu: remove collapse/expand inconsistencies
|
|
* dashboard: fix disabled widgets dialog
|
|
* nat: fixed delete of multiple item
|
|
* nat: fix display of disabled rules
|
|
* queues: the legacy ALTQ traffic shaper is now found under
|
|
"Firewall: Queues" to make room for the upcoming traffic shaper
|
|
reimplementation based on IPFW/dummynet
|
|
* core: fix faulty read of /var/log/dmesg.boot
|
|
|
|
The live upgrades are up for both LibreSSL and OpenSSL. Images will follow
|
|
in a later announcement as the testing backlog has gotten larger with more
|
|
images and flavours. We are working on a Continuous Integration platform,
|
|
but for now we're still doing things manually.
|
|
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.10.2 (May 13, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
We are happy to announce OPNsense 15.1.10.2 today following a rather
|
|
exciting firmware upgrade bug that prevented the release yesterday.
|
|
We are back to normal now thanks to the wonderful people of pkgng, and,
|
|
boy, do we have news to share.
|
|
|
|
First and foremost, it's time to reveal to all of you the Proxy Server
|
|
(based on squid) work we've done under the hood for a few months now.
|
|
The new MVC framework has been plugged seamlessly into the GUI and can
|
|
be inspected under "Services: Proxy Server". This is a sneak preview of
|
|
things to come and any help in testing and commenting on the feature is
|
|
going to be a huge help as we go forward.
|
|
|
|
The translation project has been kickstarted for Japanese `[1] <http://dotike.github.io/opnsense.core.ja_JP.UTF8/>`__ and Chinese,
|
|
although the translations are not yet available in the GUI due to their
|
|
incompleteness. We do, however, think this is a good opportunity to ask
|
|
for contributions to the translations and welcome efforts for other
|
|
languages as well.
|
|
|
|
Last but not least HardenedBSD's work `[2] <https://hardenedbsd.org/article/shawn-webb/2015-05-08/hardenedbsd-teams-opnsense>`__ to build OPNsense on top of their
|
|
code has been a quick success story and will eventually bring features like
|
|
ASLR into the project. The cooperation also sparked a number of build tools
|
|
improvements that will make maintaining the project easier in the future.
|
|
Changes also help to unify the OpenSSL/LibreSSL release handling so that
|
|
with this announcement you will be enjoying your timely LibreSSL firmware
|
|
upgrade. ;)
|
|
|
|
Here is the full list of changes:
|
|
|
|
* proxy: basic proxy features on top of our new and shiny MVC framework
|
|
under "Services: Proxy Server"
|
|
* proxy: smart tokens for item lists (copy/paste CSV list into them and
|
|
watch the magic happen)
|
|
* proxy: help on/off per item or full page
|
|
* proxy: hide advanced options and include sane defaults
|
|
* proxy: FTP proxy included with same ACL controls as HTTP
|
|
* proxy: simple authentication using built-in user database
|
|
* openvpn: added Tunnelblick's version of the OpenVPN XOR feature for
|
|
protocol obfuscation `[3] <https://code.google.com/p/tunnelblick/wiki/cOpenvpn_xorpatch>`__
|
|
* core: fixed config.xml section import regression
|
|
* core: stripped numerous dynamic strings from gettext() invokes
|
|
* ports: added FreeBSD's 10.1 ifinfo tool to probe for interface statistics
|
|
to replace legacy PHP module code
|
|
* ports: bsdinstaller 2.3 no longer uses cpdup utility, plus log collection
|
|
and SONAME fixes
|
|
* ports: updated to pkg 1.5.2, phalcon 2.0.0, dnsmasq 2.72_1 `[4] <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3294>`__
|
|
* ports: perl5 is now installed by default (5.18)
|
|
* development: OpenSSL and LibreSSL branches have been merged for a simpler
|
|
build experience and smaller release times
|
|
* development: the package sets are now always kept as a single archive that
|
|
can be reused and recompiled (even selectively)
|
|
* development: stable translation template file is available now `[5] <https://raw.githubusercontent.com/opnsense/core/master/src/share/locale/en_US/LC_MESSAGES/OPNsense.pot>`__
|
|
* development: kickstarted Japanese and Chinese translations
|
|
* development: language translation files are now automatically compiled
|
|
into the core package
|
|
* development: added a persistent build config file for setting the version,
|
|
crypto flavour and release version tag (if applicable)
|
|
|
|
The update is available via the firmware upgrade feature only.
|
|
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.10.1 (May 06, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
Here comes a quick hotfix for a pressing VLAN regression we've been hearing
|
|
about today plus 3 more minor additions. These are the patch notes:
|
|
|
|
* interfaces: fix interface rename regression that prevented VLANs from
|
|
being set up
|
|
* firmware: clean up downloaded packages after installation
|
|
* logging: prevent spurious pgrep-related messages from being logged
|
|
* config: fix Google Drive backup accounting off-by-two
|
|
|
|
The update available via the GUI or console firmware upgrade. No restarts
|
|
necessary, except for those being affected by the VLAN regression. Let us
|
|
know whether this brings you back to normal.
|
|
|
|
Both LibreSSL and OpenSSL are available as of now!
|
|
|
|
|
|
Stay safe,
|
|
Your OPNsense team
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.10 (May 04, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
The new release is finally here! Yet before we begin, we'd like to stress
|
|
this part: please read the notes enclosed; they are important for the future
|
|
of OPNsense.
|
|
|
|
We are now about two thirds into what is going to be 15.7. On this path,
|
|
we've always released cutting edge snapshot releases and 15.1.10 is no
|
|
different. However, what is different is the fact that this release marks
|
|
a larger departure from what is considered a mere fork: we are leaving
|
|
behind numerous kernel patches and two major features to better align with
|
|
FreeBSD's code base and to rebuild these features on more maintainable
|
|
fundament. In this case we're talking about the layer 7 shaper and
|
|
FAIRQ/CODEL support.
|
|
|
|
But we not only delete all the things. No, we have added NanoBSD images to
|
|
the release bundle. Reengineered the process to keep completely in sync with
|
|
the FreeBSD ports collection. Replaced the GUI menu and ACL with MVC-based
|
|
rewrites. We've switched on the fingerprint verification to finally enforce
|
|
the (previously introduced) package repository signing.
|
|
|
|
It's very likely that most of these additions and removals are not visible
|
|
from a usage perspective and we do believe that is a good thing. For some
|
|
these changes will spark criticism, but then again they are a chance to
|
|
better distinguish between projects and individual requirements. We believe
|
|
in choice. We believe in the choices we make for the benefit of our users.
|
|
And we intend to keep it that way for a long time. Talk to us and let us
|
|
know what we can achieve together. :)
|
|
|
|
Important notes on the live upgrade:
|
|
|
|
The recommended way to upgrade is the root shell menu option "12". The box
|
|
will require an immediate reboot. No further steps will be necessary.
|
|
|
|
The GUI firmware upgrade has never been perfect due to wanting to upgrade
|
|
itself through running the update. The GUI update is still safe to run, but
|
|
it will not let you know when it is finished. The update window will go
|
|
blank, which is your queue to refresh the page. The login window will
|
|
reappear. After login, the GUI update will already be finished. To wrap
|
|
up the full upgrade cycle, drop to the root shell and type:
|
|
|
|
.. code-block::
|
|
|
|
# opnsense-update && reboot
|
|
|
|
But then again, simply use the root shell menu option "12". It works
|
|
seamlessly via SSH, too.
|
|
|
|
The full change log of 15.1.10 is as follows:
|
|
|
|
* kernel: cleaned up the custom legacy patches to move the underlying
|
|
FreeBSD back to more standard behaviour
|
|
* kernel: removed dysfunctional dummynet patches and traffic shaper / limiter
|
|
GUI feature (ETA for a replacement is 15.7)
|
|
* kernel: stripped FAIRQ and CODELQ disciplines as they are no longer
|
|
supported by FreeBSD
|
|
* kernel: isolated MPD (Multi-link PPP daemon) alteration patches
|
|
(will be dropped in a future release)
|
|
* kernel: fixed IPSec dropping connections in some scenarios
|
|
* images: a new NanoBSD-based image has been added to the release
|
|
bundle (directly written to SD or HD)
|
|
* notable ports updates: curl 7.42.1, ca_root_nss: 3.18.1
|
|
* installer: omit swap and add noatime to root partition in quick/easy
|
|
install when available space is under 30GB, fixed faulty exit on
|
|
importer cancel
|
|
* development: the ports tree is now kept fully in sync with FreeBSD
|
|
* development: improved the ports build script in terms of error reporting
|
|
and rebuilding speed
|
|
* development: simplified file system path handling in most files to make
|
|
the code easier to maintain
|
|
* development: fixed a bug that prevented extracting our packages on ZFS
|
|
* core: replaced most of the legacy PHP module usage with more portable
|
|
(and maintainable) scripting code
|
|
* dashboard: fixed the main link to always land on the dashboard to not
|
|
confuse a restricted ACL setup
|
|
* traffic shaper: layer 7 filter removed as the project has been abandoned
|
|
(ETA for a replacement is 16.1)
|
|
* system/settings: added an FTP proxy feature for clients trying to do
|
|
active transfers
|
|
* menu: replaced the old one with the new MVC equivalent plus assorted
|
|
improvements
|
|
* ACL: replaced the old one with the new MVC equivalent
|
|
* login: polished the login screen behaviour
|
|
* backend: don't try to send a signal to non-existing process
|
|
* user: can now change the password via "User: Change Password" from the menu
|
|
* firmware: enforce signed packages on upgrade for our mirrors
|
|
* rrd: fixed directory create-after-use
|
|
|
|
The images can be acquired from here:
|
|
|
|
https://opnsense.org/download/
|
|
|
|
Last but not least, checksums are:
|
|
|
|
.. code-block::
|
|
|
|
# SHA256 (OPNsense-15.1.10-cdrom-amd64.iso.bz2) = 27deac90b9e2e43fa71ff68c30b5fb28d3afcfb12483e01ff52ea40e8ca6f4a8
|
|
# SHA256 (OPNsense-15.1.10-nano-amd64.img.bz2) = e61007bd2a735cdc8301d90431b6bb23dc425dfe3d7cdae162b16bd6f0dfd4a3
|
|
# SHA256 (OPNsense-15.1.10-serial-amd64.img.bz2) = c7a412b1cc74331ebf13c8e95316c4c11ee56a331d7992a3bb27e80e0ce9a127
|
|
# SHA256 (OPNsense-15.1.10-vga-amd64.img.bz2) = 1d9449b6bc61904995189cf264ec9c071a7effb4c203579778c827262bb88654
|
|
# SHA256 (OPNsense-15.1.10-cdrom-i386.iso.bz2) = f6e7e4953cdb155490136134393892e92414e3a70baf419ba6c5319e58d45620
|
|
# SHA256 (OPNsense-15.1.10-nano-i386.img.bz2) = 4e85700f4c491529f8ec60da09283674f29bfdbede83e372a95fc3719f20a661
|
|
# SHA256 (OPNsense-15.1.10-serial-i386.img.bz2) = 786a5d831e37ac4d55618b5fc1ae0af1a5bfde52b048f185c5ce16f4f18821b9
|
|
# SHA256 (OPNsense-15.1.10-vga-i386.img.bz2) = 6cf6c88bfa910da402e96a883bef7766570b9500941d7c5549e050bc8d74818c
|
|
|
|
.. code-block::
|
|
|
|
# MD5 (OPNsense-15.1.10-cdrom-amd64.iso.bz2) = d6f9f4736c911157067b47b8e1793a0e
|
|
# MD5 (OPNsense-15.1.10-nano-amd64.img.bz2) = a4a6ed4a51cf501d5a27041f9255694a
|
|
# MD5 (OPNsense-15.1.10-serial-amd64.img.bz2) = 719665d9b5e9e8d48f88b8e2b6cf177b
|
|
# MD5 (OPNsense-15.1.10-vga-amd64.img.bz2) = 4f1f9a2d5fdc176e7516660ea34c6564
|
|
# MD5 (OPNsense-15.1.10-cdrom-i386.iso.bz2) = 7a7bbabc27d596b0da8874ca4e31714d
|
|
# MD5 (OPNsense-15.1.10-nano-i386.img.bz2) = a3a6d4d96217e6c86e430e9766971049
|
|
# MD5 (OPNsense-15.1.10-serial-i386.img.bz2) = 6d3a5c3dbe02d6012d50219aaab4b7c6
|
|
# MD5 (OPNsense-15.1.10-vga-i386.img.bz2) = 5ec2c602a8e3f31ad78c2f63c2d266b9
|
|
|
|
|
|
May the force be with you,
|
|
Your OPNsense team
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.9.2 (April 22, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
Another week, another stable release. :) While we are busy working on
|
|
extensive kernel cleanups to bring OPNsense closer to FreeBSD, we decided
|
|
to ship a minor update today with a number of third-party software refreshes
|
|
and assorted fixes across the board before we make the leap to 15.1.10.
|
|
|
|
We'd like to mention the extensive translation groundwork being done by
|
|
Isaac Levy, which will enable others to start working on specific language
|
|
support now that there's an official English translation in the system. A
|
|
Japanese translation is being discussed already -- if you'd like to contribute
|
|
other language translations let us know through the usual channels. We'd be
|
|
more than happy to include them into a future release.
|
|
|
|
Here is the full change log of 15.1.9.2:
|
|
|
|
* captive portal: fixed rule generation on empty IP
|
|
* gui: print current user in upper right corner along with the hostname
|
|
* user manager: fixed empty password error when creating a new user
|
|
* high availability: don't trigger sync when not configured
|
|
* interfaces: added the hn(4) interfaces as ALTQ capable
|
|
* configuration: do not overwrite the default configuration on firmware
|
|
updates
|
|
* ipsec: fixed road warrior authentication
|
|
* openvpn: fixed client edit link
|
|
* ports: sqlite 3.8.9 `[1] <https://sqlite.org/releaselog/3_8_9.html>`__
|
|
* ports: strongswan fix for xauth (road warrior-related)
|
|
* ports: PHP 5.6.8 `[2] <https://php.net/ChangeLog-5.php#5.6.8>`__
|
|
* ports: pkg 1.5.1 `[3] <https://lists.freebsd.org/pipermail/freebsd-stable/2015-April/082234.html>`__
|
|
* development: kickstarted language support via English
|
|
translation (.pot file)
|
|
* development: further progress on the proxy feature/MVC framework
|
|
* development: improved the live mount to propagate the mounted version
|
|
into the dashboard
|
|
|
|
The update is not available via install media, but you can just as well
|
|
download 15.1.9 from a mirror and upgrade with a few simple clicks:
|
|
|
|
https://opnsense.org/download/
|
|
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.9.1 (April 16, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
Today we present you a quiet stable update with a hand full of assorted
|
|
features, tweaks and bug fixes. Most notably, we've integrated DNS filtering
|
|
via OpenDNS and tested / reworked the IPSec reporting.
|
|
|
|
As far as we know there have been no security-related fixes of bundled
|
|
third-party software since 15.1.9.
|
|
|
|
Update through the GUI via "System: Firmware" or the root console option
|
|
"12) Upgrade from console". A reboot is not strictly required, but
|
|
recommended to trigger the automatic enable of soft updates and TRIM
|
|
(if applicable to your disk).
|
|
|
|
Here is the full change log of 15.1.9.1:
|
|
|
|
* firmware: show a warning on pending system updates that need to be executed
|
|
from the console
|
|
* system: "General Setup" and "Advanced" items have been merged into "Settings"
|
|
* system: "Certificate Manager" is now known as "Certificates", default tab
|
|
changed as well
|
|
* services: introduce OpenDNS-based DNS filtering
|
|
* services: fixed start button layout when service is offline
|
|
* ports: fixed StrongSwan SMP socket bind on FreeBSD
|
|
* ipsec: brought back tunnel status reporting
|
|
* ipsec: fixed "Do not install LAN SPD" setting
|
|
* user manager: fixed group permission and privilege read bugs
|
|
* wake on lan: fixed "Cannot create references to/from string offsets nor
|
|
overloaded objects" error
|
|
* openvpn: fixed server restart regression
|
|
* core: automatically enable TRIM on boot if available
|
|
|
|
The update is not available via install media, but you can just as well
|
|
download 15.1.9 from a mirror and upgrade with a few simple clicks:
|
|
|
|
https://opnsense.org/download/
|
|
|
|
|
|
Stay safe out there,
|
|
Your OPNsense team
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.9 (April 10, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
Although we have already released 15.1.8.4 early this week, we're pushing out
|
|
15.1.9 for two important reasons: security updates, kernel panic fixes and
|
|
clean images as we've had a couple of things that needed addressing following
|
|
the configuration system rewrite in 15.1.8. That's three important reasons
|
|
really. ;)
|
|
|
|
The recommended upgrade method is the root console option 12 to properly
|
|
update both the packages and the base system to the latest available
|
|
releases. Please verify that the system information widget on the dashboard
|
|
presents you with the following and new version information (will show
|
|
"i386" as opposed to "amd64" if you use the 32 bit version):
|
|
|
|
.. code-block::
|
|
|
|
# OPNsense 15.1.9-amd64
|
|
# FreeBSD 10.1-RELEASE-p9
|
|
# OpenSSL 1.0.1m 19 Mar 2015
|
|
|
|
Alternatively, you can choose to boot a fresh install media and do a clean
|
|
config import followed by an immediate installation to retain your full setup.
|
|
|
|
As always, back up your configuration to an external location prior to
|
|
upgrading.
|
|
|
|
LibreSSL images and updates are expected later today. Please watch out for
|
|
the announcement on Twitter, IRC, the forum or elsewhere. LibreSSL is still
|
|
an experimental release despite the fact we keep it up to date and mix
|
|
LibreSSL updates into the shared patch notes.
|
|
|
|
Here is the change log for 15.1.9:
|
|
|
|
* tools: install media live images now use the more flexible tmpfs(5)
|
|
* tools: cxgbe(4) is now compiled into the kernel
|
|
* ports: strongswan 5.3.0 `[1] <https://www.strongswan.org/blog/2015/03/30/strongswan-5.3.0-released.html>`__ , openssh-portable 6.8p1 `[2] <http://www.openssh.com/txt/release-6.8>`__ , ntp 4.2.8p2 `[3] <http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities>`__
|
|
* src: reverted inconsistent carp(4) and pfsync(4) patches to retain
|
|
standard FreeBSD behaviour
|
|
* src: fix multiple vulnerabilities of ntp `[4] <https://www.freebsd.org/security/advisories/FreeBSD-SA-15:07.ntp.asc>`__
|
|
* src: fix denial of service with IPv6 router advertisements `[5] <https://www.freebsd.org/security/advisories/FreeBSD-SA-15:09.ipv6.asc>`__
|
|
* core: console upgrade now also triggers the unused package removal
|
|
* core: fix regression that caused a faulty config.xml when applying limiter
|
|
settings
|
|
* core: refactored the configd command structure for clarity
|
|
* core: fix for SMTP notifications that broke due to PHP 5.6's new default
|
|
SSL behaviour
|
|
* core: thorough unused java script purge under the hood
|
|
* upnp: fix redeclaration error on main page shortcut click
|
|
* user manager: consolidated the labels of all privileges, especially OpenVPN
|
|
* development: opnsense-update can selectively upgrade base/kernel for testing
|
|
* development: new chunk of progress on the new proxy feature and MVC structure
|
|
|
|
The images can be found on a mirror of your choosing:
|
|
|
|
https://opnsense.org/download/
|
|
|
|
The checksums are:
|
|
|
|
.. code-block::
|
|
|
|
# SHA256 (OPNsense-15.1.9-cdrom-amd64.iso.bz2) = d159a791cbc373435f25c74f433cc6b419fd8d6df8940d854fec6cd07545acd4
|
|
# SHA256 (OPNsense-15.1.9-serial-amd64.img.bz2) = 0584fa5092c40af9f8523be527408af57eac2ca71c9522e8167f7ae7f08e0586
|
|
# SHA256 (OPNsense-15.1.9-vga-amd64.img.bz2) = ccd550b471aa6b13d9a8921aa9461d5eddedaeb9c375e97261ff4e54ebd881d2
|
|
# SHA256 (OPNsense-15.1.9-cdrom-i386.iso.bz2) = dd3816e0b9c166009de0bde47adce28472bcc639918de91813db4b0ad3bd863e
|
|
# SHA256 (OPNsense-15.1.9-serial-i386.img.bz2) = 6b39d3a3ede80f6996c589eeeb39b0777b3ae878f79101b85f9b7af3dad771d3
|
|
# SHA256 (OPNsense-15.1.9-vga-i386.img.bz2) = 56b401719811d233cfd476f49501c436e0f3f02422a1bbc711aa70c0a1a4e340
|
|
|
|
.. code-block::
|
|
|
|
# MD5 (OPNsense-15.1.9-cdrom-amd64.iso.bz2) = 82b9575e8070248d52b01baae9d31544
|
|
# MD5 (OPNsense-15.1.9-serial-amd64.img.bz2) = 3f516cfb088d13f747bc68a0725b955d
|
|
# MD5 (OPNsense-15.1.9-vga-amd64.img.bz2) = 14f035f45c89f5fd404881baac93528f
|
|
# MD5 (OPNsense-15.1.9-cdrom-i386.iso.bz2) = 09e724a1313f5ebbbfcbf61c62e0803d
|
|
# MD5 (OPNsense-15.1.9-serial-i386.img.bz2) = 736069fb503de87599b0f866a47fdb02
|
|
# MD5 (OPNsense-15.1.9-vga-i386.img.bz2) = c79f0c9fe2a0fcb4d8f4ff18146fe340
|
|
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.8.4 (April 07, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
We hereby proudly announce our latest and greatest stable update 15.1.8.4.
|
|
This is almost completely GUI-oriented (frontend and backend) due to numerous
|
|
cleanups we've done in pursuit of the 15.1.8 release and its new config
|
|
subsystem. A huge thank you goes to everybody who submitted bugs over the
|
|
course of the last week.
|
|
|
|
The firmware upgrade is online-only, so either go through the GUI or the
|
|
console. A bit of bumpiness may be present in the GUI upgrade. After PHP
|
|
packages have been removed you can safely steer away from the page and
|
|
recheck for firmware updates to make sure the firmware has been upgraded
|
|
correctly.
|
|
|
|
Here is the full list of changes:
|
|
|
|
* core: removed numerous unused function from the code base
|
|
* core: fixed numerous :code:`Illegal string offset` warnings
|
|
* core: fixed numerous `Cannot create references to/from string offsets
|
|
nor overloaded objects' errors related to 15.1.8's config system switch
|
|
* captive portal: properly redirect to original page after entering a
|
|
valid voucher
|
|
* xmlrcp: replaced the whole legacy implementation due to issues with the
|
|
latest PHP version to unbreak the feature
|
|
* core: fixed an ancient background execution bug that prevented the spawned
|
|
process from fully detaching from its parent
|
|
* firmware: completely detached the firmware upgrade from the GUI to make
|
|
it more reliable and hide empty update tables
|
|
* dashboard: polish the version information print and also show
|
|
OpenSSL/LibreSSL version for better awareness
|
|
* xmlrpc: removed dangerous PHP and shell execution hooks
|
|
* core: removed the backwards compatibility code for base OpenSSL as we
|
|
don't want to use it anymore
|
|
* core: fixed unstable GUI and console factory reset
|
|
* system settings: finally flipped the SSH key only checkbox to properly
|
|
align with the underlying settings name of :code:`PasswordAuthentication`
|
|
* core: removed usage of numerous legacy PHP plugins in favour of more
|
|
portable approaches
|
|
* logs: captive portal logs now have the proper layout
|
|
* logs: fixed firewall log parsing to unhide log entries for IP protocols
|
|
that were not TCP/UDP/ICMP
|
|
* crash reporter: revamp the crash report layout and add appropriate feedback
|
|
messages (note that the send button isn't enabled but we'll get there)
|
|
* interfaces: fixed WAN PPPOE edit
|
|
* configd: do not emit an error on shutdown
|
|
* configd: gained a background execution feature
|
|
* development: added hooks for running custom rc scripts
|
|
* development: enable PHP warnings for core.git mount
|
|
|
|
If you do not possess a running installation, the images for 15.1.8 are
|
|
available through at least one of our shiny new our mirrors. Make sure
|
|
you upgrade to 15.8.1.4 as soon as you installed 15.1.8 to avoid all
|
|
unnecessary hiccups:
|
|
|
|
https://opnsense.org/download/
|
|
|
|
|
|
Stay safe,
|
|
Your OPNsense team
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.8.3 (March 30, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
The new config system had a number of issues, but thanks to your help we've
|
|
ironed them out in the two days following the release. The trend continues
|
|
with this small stable update fixing the last batch of visible issues while
|
|
also pulling in PHP 5.6.7, which isn't currently available in FreeBSD ports.
|
|
|
|
Here is the full change log:
|
|
|
|
* ports: PHP was updated to 5.6.7 addressing CVE-2015-0231,
|
|
CVE-2015-2305, etc. `[1] <https://php.net/ChangeLog-5.php#5.6.7>`__
|
|
* captive portal: service now restarts correctly when triggered from the GUI
|
|
* ipsec: multiple config system replacement regression fixes
|
|
* dhcp: fixed the flushing of v6 settings while applying them
|
|
* user manager: fixed a bug that would remove groups
|
|
* firewall rules: prevent delete rule from deleting all rules
|
|
* core: ignore empty tags in configs generated by frontend code
|
|
* The update is available for both of the crypto flavours OpenSSL and
|
|
LibreSSL through the System/Firmware section of the GUI. If you are
|
|
upgrading from pre-15.1.7.1 don't forget to run "opnsense-update && reboot"
|
|
on a root shell to bring in the latest base fixes afterwards as well.
|
|
Installations of 15.1.7.1 and higher can use the console firmware upgrade
|
|
option 12 to run an adaptive update cycle (depending on how much needs to
|
|
be updated the system may reboot).
|
|
|
|
As always, please back up your config and let us know if you run into any
|
|
trouble. :)
|
|
|
|
https://opnsense.org/support-overview/mailing-list
|
|
https://twitter.com/opnsense
|
|
https://github.com/opnsense
|
|
https://forum.opnsense.org
|
|
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.8.2 (March 25, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
After an extended low profile period we are back in business with the latest
|
|
and greatest 15.1.8. You'll notice that we have incorporated the recent
|
|
OpenSSL security advisories along with a larger number of fixes and cleanups.
|
|
But there's more. We have pushed the bulk load of our new configuration
|
|
handling code which is intended to bridge the gap between the old and the
|
|
new front-end code. And since we don't like to stop there just yet, we've
|
|
also added support for backing up your configs on your private Google Drive.
|
|
|
|
We encourage our users running 15.1.7.1 or later to try the root console menu
|
|
option "12" for a fully automatic system upgrade. Otherwise, it's either
|
|
installing from scratch using install media and the installer's config import
|
|
feature, or running the GUI firmware update and dropping to a root shell to
|
|
run :code:`opnsense-update && reboot` to fully benefit from the base system
|
|
security updates. Please let us know about your upgrade experience. We are
|
|
still adding and tweaking code to complement and simplify the upgrade process.
|
|
|
|
Users of the install media are encouraged to update their firmware via the GUI
|
|
from 15.1.8 to 15.1.8.2 as soon as possible due to a few important config
|
|
system hotfixes.
|
|
|
|
Here is the full list of changes:
|
|
|
|
* src: applied FreeBSD-SA-15:06.openssl `[1] <https://www.freebsd.org/security/advisories/FreeBSD-SA-15:06.openssl.asc>`__
|
|
* src: updated to tzdata2015b `[2] <http://mm.icann.org/pipermail/tz-announce/2015-March/000029.html>`__
|
|
* src: add missing max-packets parsing for pf(4)
|
|
* src: OPNsense branding for boot loader
|
|
* bsdinstaller: speed up SD card writes using async mode and assorted cleanups
|
|
* opnsense-update: don't trigger a spurious update after a fresh install when
|
|
invoked for the first time
|
|
* notable port updates: isc-dhcp42 4.2.8, libressl 2.1.6 (hopefully builds
|
|
will be available on Friday), openssl 1.0.1m, ca_root_nss 3.18
|
|
* core: removed obsolete conf_mount_ro() and conf_mount_rw() usage
|
|
* core: removed platform awareness with a more appropriate probe for install
|
|
media
|
|
* core: removed all remnants of the old firmware update code
|
|
* core: completely rewrote the config.xml handling to unify old and new GUI
|
|
components
|
|
* core: added support for config backup to Google Drive `[3] <https://wiki.opnsense.org/index.php/Manual:Backup_to_Google_Drive>`__
|
|
* core: fixed a few config handling issues with the new system via 15.1.8.1
|
|
* core: fixed missing aliases in new config system via 15.1.8.2
|
|
* core: removed php-fpm remnants that would e.g. prevent automatic IP
|
|
assignment in DHCP mode via 15.1.8.2
|
|
* packages: removed the legacy package system
|
|
* upnp: transformed the preinstalled package into a standard feature
|
|
* openvpn: added the client export package as a standard feature
|
|
* dyndns: minor follow-ups for Duck DNS support
|
|
* firewall log: fix bug that would prevent the filter from working correctly
|
|
* ntp: added numerous config form tweaks and fixed daemon startup
|
|
* igmpproxy: fixed daemon startup
|
|
* dns: properly regenerate hosts file on reload
|
|
* ssh: fix sshd reload on save in system admin access page
|
|
* src: avoid invoke of FreeBSD's rc system on halt and reboot
|
|
* dhcp: improve compatibility with IPv6 deployments
|
|
|
|
The install media images can be found here:
|
|
|
|
https://sourceforge.net/projects/opnsense/files/15.1.8/
|
|
|
|
The checksums are:
|
|
|
|
.. code-block::
|
|
|
|
# SHA256 (OPNsense-15.1.8-cdrom-amd64.iso.bz2) = c8cb295cd711f880e6406ab8d84c84a31cdc678c40e4d3be4c3fe9546614bdcc
|
|
# SHA256 (OPNsense-15.1.8-serial-amd64.img.bz2) = 1d51a7d229a145eb92517211a96d9c9bcb0e3585c21931406463368349129997
|
|
# SHA256 (OPNsense-15.1.8-vga-amd64.img.bz2) = 9a9777af215e66dfa4032d2052f320234c32809816094c1a58d2ebe5c81bdd1a
|
|
# SHA256 (OPNsense-15.1.8-cdrom-i386.iso.bz2) = e1d1b11ac23a043ab0bdff2a923a8a920814f72e79b852f39e66f185963f8cc4
|
|
# SHA256 (OPNsense-15.1.8-serial-i386.img.bz2) = fe078471b8409a2102f216252db4f59580853a0182c33d39d4b2c676a1f9e3b7
|
|
# SHA256 (OPNsense-15.1.8-vga-i386.img.bz2) = df7ca44649f7283df774acddc2df7e06961d80033e959cde01ebce664bf6f488
|
|
|
|
.. code-block::
|
|
|
|
# MD5 (OPNsense-15.1.8-cdrom-amd64.iso.bz2) = 79eff753cdb749dacb9e106a1781ce64
|
|
# MD5 (OPNsense-15.1.8-serial-amd64.img.bz2) = 8e643edf6d6cee72535bd8913cf4176e
|
|
# MD5 (OPNsense-15.1.8-vga-amd64.img.bz2) = c20fee3989a786e12ba0ec3f0e565660
|
|
# MD5 (OPNsense-15.1.8-cdrom-i386.iso.bz2) = 8b8459017333d654c8b1a7f246a4e250
|
|
# MD5 (OPNsense-15.1.8-serial-i386.img.bz2) = 6f2e9656a02f32cebf18c9b31b5439f2
|
|
# MD5 (OPNsense-15.1.8-vga-i386.img.bz2) = 4cbbebe46142d1e954c76383340f61e6
|
|
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.7.2 (March 13, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
This week has been really quiet just like last week so we give you another
|
|
tiny stable update in the style of "click-click-click-done". Most notably,
|
|
we've tracked down two issues with the package database being unavailable,
|
|
resulting in "no updates available" situations. Thanks again to everyone
|
|
who helped to debug and test this with us!
|
|
|
|
We are not aware of any security issues at this point. Our LibreSSL efforts
|
|
continue with 15.1.7.2-LibreSSL later today and it seems to be an extended
|
|
work in progress as we uncover just how deep OpenSSL is tied into the FreeBSD
|
|
ecosystem. Needless to say it shouldn't be this way, but we're getting there
|
|
step by step.
|
|
|
|
For everybody running 15.1.7.1 that might be a good opportunity to try the
|
|
root console menu option 12 to update in one single go (including available
|
|
base updates). It can also be invoked via SSH if you are into that sort of
|
|
headless/remote workflow.
|
|
|
|
Here is the full list of changes:
|
|
|
|
* bsdinstaller: fixed the package database wipe on custom install
|
|
* bsdinstaller: install progress bar is now more responsive with regard to
|
|
individual directories in /usr
|
|
* firmware: removed obsoleted upgrade code and tools following our
|
|
pkgng/opnsense-update approach
|
|
* miniupnpd: now properly links to the OpenSSL/LibreSSL port
|
|
* ipmitool: now properly links to the OpenSSL/LibreSSL port
|
|
* core: extensive cleanups for PHP shebang usage, wiped numerous unused
|
|
scripts and unreachable web pages, removed PBI remnants, removed 'tmp_path'
|
|
softcoding to improve readability and git-grep(1) experience, removed stale
|
|
debug statement that were only marginally useful while bumping the
|
|
statements to default that indicate real errors
|
|
* console: fixed halt script permissions and switched to synchronous mode
|
|
* sysctl: added net.inet6.ip6.rfc6204w3 to improve the DHCPv6 experience
|
|
* nat: remove target IP hardcoding in automatic rules (props to pfSense for
|
|
pointing that out to us)
|
|
* rc: fixed missing package database when using the MFS option for /var
|
|
* configd: added a standard rc.d script for easy daemon control
|
|
* mvc: a lot of new code to support general infrastructure for upcoming
|
|
porting of features, e.g. proxy feature
|
|
* help: adjusted links in the help menu to use HTTPS and improved targeting
|
|
|
|
If you are new to OPNsense, the 15.1.7 images can be found here and are easily
|
|
updated through the GUI after installation:
|
|
|
|
https://sourceforge.net/projects/opnsense/files/15.1.7/
|
|
|
|
|
|
Stay safe,
|
|
The OPNsense team
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.7.1 (March 07, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
As things mature and confidence grows we are trying something new today: a
|
|
lightweight and online-only stable update that addresses numerous GUI bugs
|
|
uncovered by our users. We hope to continue this trend and thus keep asking
|
|
for all kinds of feedback through the usual communication channels. Let's
|
|
build a better OPNsense together.
|
|
|
|
There are no security issues we are aware of. The LibreSSL version will
|
|
likely be available tomorrow.
|
|
|
|
Here are the full patch notes:
|
|
|
|
* bsdinstaller: work towards embedded installations, e.g. Quick/Easy disk
|
|
selection
|
|
* opnsense-update: added command line switches and a manual page for
|
|
usability's sake
|
|
* opnsense-update: will now remember that the base system is up to date
|
|
* ports: updated to LibreSSL 2.1.4 (for our experimental LibreSSL flavour only)
|
|
* directory layout: collapsed the /conf -> /cf/conf magic into a simple /conf
|
|
directory (needs a reboot to take effect)
|
|
* certificates: consistently lowered the default lifetime to 1 year
|
|
* captive portal: fixed an issue that prevented traffic forwarding in some
|
|
cases
|
|
* nat: do not resolve aliases on display to stay consistent with rules page
|
|
* console menu: rebuilt the firmware upgrade option 12 to work on top of our
|
|
new pkgng/opnsense-update system
|
|
* crash reporter: can now be found under Diagnostics and was extended to show
|
|
all parsing errors. The send button is currently disabled but feel free to
|
|
copy+paste the messages to push them through the usual channels.
|
|
* rc: fixed numerous parse errors in files previously missed by the regression
|
|
test
|
|
* rc: DHCP lease and RRD graph persistency after reboot, halt and config
|
|
import (reinstall)
|
|
* upnp: the shortcuts menu has been reintroduced
|
|
* login: redirect after login now brings up the previously selected page
|
|
* dynamic dns: fixed validation for custom entries that do not require a
|
|
hostname
|
|
* dynamic dns: added support for Duck DNS
|
|
* firewall log widget: fixed multiple bugs and updated style
|
|
* pptp: brought back missing PHP includes
|
|
* core: removed thousands of lines of unused code, style consolidation and
|
|
path unwinding
|
|
* core: multiple image to glyphicon conversions
|
|
* development: moved pkgng config files out of the src/ directory to avoid
|
|
tainting the system on core.git live mount
|
|
* development: steady progress on the first MVC framework implementation of
|
|
the upcoming proxy support
|
|
|
|
If you are new to the show, you want to grab the latest image from Sourceforge
|
|
and apply this update afterwards using the firmware update in the GUI:
|
|
|
|
https://sourceforge.net/projects/opnsense/
|
|
|
|
|
|
Stay safe,
|
|
The OPNsense team
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.7 (February 28, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
We are saddened by the news of Leonard Nimoy passing away. He has been an
|
|
inspiration for many of us ever since Star Trek first flickered over the TV
|
|
screens and all the years thereafter. What a strange world we'd live in if
|
|
it weren't for him? Thank you, Leonard, 15.1.7 is being released in your
|
|
honour.
|
|
|
|
As we move forward, we've found that 15.1.6.1's new tool opnsense-update
|
|
works really well for everybody and thus we are very happy with the new
|
|
live upgrade path. To show you that we are super serious we are shipping
|
|
the latest FreeBSD 10.1 release engineering and security advisories and
|
|
encourage you to try it out. We also have numerous tweaks with regard to
|
|
tightening security in Bind, OpenSSL, StrongSwan, OpenSSH as well as needed
|
|
GUI fixes thanks to the steady stream of incoming reports. If you encounter
|
|
an issue or even a slight hiccup, please let us know through any of the
|
|
available channels.
|
|
|
|
The images can be found here:
|
|
|
|
https://sourceforge.net/projects/opnsense/files/15.1.7/
|
|
|
|
How to upgrade:
|
|
|
|
Always backup your config. Do not try to go from the LibreSSL snapshot to
|
|
OpenSSL. The parallel LibreSSL snapshot will be out by tomorrow.
|
|
|
|
Do a clean install using the desired install media. You can always import
|
|
the old configuration from the installer if you already have an older
|
|
installation.
|
|
|
|
Alternatively and experimentally, upgrade using the firmware update, then
|
|
drop to a root shell and issue the following commands.
|
|
|
|
.. code-block::
|
|
|
|
# opnsense-update && reboot
|
|
|
|
At this point, using any of the two methods, you should be on OPNsense
|
|
15.1.7-78bdb9aef FreeBSD 10.1-RELEASE-p6.
|
|
|
|
This is the official change log:
|
|
* Fix integer overflow in IGMP protocol `[1] <https://www.freebsd.org/security/advisories/FreeBSD-SA-15:04.igmp.asc>`__
|
|
* Fix vt(4) crash with improper ioctl parameters `[2] <https://security.freebsd.org/advisories/FreeBSD-EN-15:01.vt.asc>`__
|
|
* Updated base system OpenSSL to 1.0.1l `[3] <https://security.freebsd.org/advisories/FreeBSD-EN-15:02.openssl.asc>`__
|
|
* Fix freebsd-update libraries update ordering issue `[4] <https://security.freebsd.org/advisories/FreeBSD-EN-15:03.freebsd-update.asc>`__
|
|
* Disabled OpenSSH's High Performance SSH/SCP and None-Cipher extensions to
|
|
follow up on several security-related discussions.
|
|
* Switched from a heavy Bind installation to a lightweight one to reduce
|
|
attack surface.
|
|
* Removed and replaced the legacy :code:`check_reload_status` daemon with a
|
|
Python-based rewrite.
|
|
* Fixed the auto-login console lockout regression introduced in 15.1.6.1.
|
|
* Fixed a problem associated with OpenVPN not being able to read passwords
|
|
from files.
|
|
* Notable ports upgrades: bind-tools 9.10.2, strongswan 5.2.2_1, curl 7.41
|
|
plus our LibreSSL fixes for mpd4/mpd5/libpdel.
|
|
* Removed PHP-FPM remnants from IPv6 and OpenVPN scripts.
|
|
* Fixed several OpenSSL invokes to use the latest port version as opposed
|
|
to the base version.
|
|
* Improved memory/disc/swap usage on the dashboard.
|
|
* Properly set DNS Resolver Advanced defaults.
|
|
* Fixed append of custom Unbound scrips.
|
|
* Modified the root menu shell to pass through to a real shell when arguments
|
|
are given.
|
|
* Zapped the spurious "Array" prefix in user-defined aliases.
|
|
* Moved the bogons files fetch location to a local mirror.
|
|
* The core.git development boot hook has been improved to properly include
|
|
/usr/local/etc/rc changes.
|
|
* All of our packages are now annotated as coming from our mirror as well as
|
|
additional safeguards potentially allowing you to use additional FreeBSD
|
|
packages on top of OPNsense.
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.6.1 (February 21, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
QUICK UPDATE: A regression sneaked into the release that renders the console
|
|
unusable when "System: Advanced: Admin Access: Console menu protection" is
|
|
being disabled. As far as we can see, this does not effect anything but the
|
|
console login so you should be able to log back in and recheck the option to
|
|
get it back (even though you will have to type the username/password).
|
|
|
|
What an intense week. The m0n0wall EoL announcement `[1] <http://m0n0.ch/wall/end_announcement.php>`__ leaves us with a long
|
|
TODO list that goes as far as realigning the project, especially in terms of
|
|
lowering hardware requirements. We're slowly getting there, but it has only
|
|
been a week for us compared to m0n0wall's 12 year track record. We ask for a
|
|
little more time and for you to keep discussing challenges and opportunities
|
|
through the available communication channels.
|
|
|
|
Speaking of track records, today we bring you 15.1.6.1, the extra one meaning
|
|
we've caught 3 issues during the release process tests and had to essentially
|
|
redo the whole thing. No idea if we keep this numbering trick or not, consider
|
|
it a little experiment.
|
|
|
|
The highlights (TL;DR): We now run FreeBSD 10.1 with lots of driver updates
|
|
and security patches on top, addressed two CVEs, introduce our base upgrade
|
|
tool opnsense-update, new naming scheme for install images and IKEv1 for IPsec.
|
|
|
|
Acquiring the release:
|
|
|
|
https://sourceforge.net/projects/opnsense/files/15.1.6.1/
|
|
|
|
Explaining the naming scheme:
|
|
|
|
* cdrom: ISO installer image with live system capabilities running in
|
|
VGA-only mode
|
|
* vga: USB installer image with live system capabilities running in
|
|
VGA-only mode
|
|
* serial: USB installer image with live system capabilities running in
|
|
serial console (115200) mode with secondary VGA support (no kernel
|
|
messages there though)
|
|
|
|
Explaining (experimental) base upgrades:
|
|
|
|
The preferred method for upgrades is still booting install media, importing
|
|
the config through the installer and reinstalling as it is a clean fallback.
|
|
Nevertheless, we've pushed a new tool that can be invoked manually on the
|
|
command line after the firmware upgrade to 15.1.6.1 has been completed.
|
|
|
|
To upgrade the base system, as root type
|
|
|
|
.. code-block::
|
|
|
|
# opnsense-update
|
|
# reboot
|
|
|
|
The immediate reboot is mandatory, but you are in charge. Again, this is
|
|
still experimental, so please report any bugs or strange behaviour running
|
|
an older release that has been upgraded in this way. If all hell breaks
|
|
loose, the config can still be recovered using the preferred upgrade method
|
|
even when the system is broken during the upgrade. And you should always
|
|
keep a backup of your config somewhere else...
|
|
|
|
Change Log 15.1.6:
|
|
|
|
* Migrated FreeBSD 10.1-RELEASE-p5 plus required custom patches
|
|
* Two additional kernel security fixes (thanks to Oliver Pinter/HardenedBSD)
|
|
* New naming scheme for installer images: cdrom, serial, vga
|
|
* New opnsense-update tool for base system upgrades
|
|
* Notable port updates: pkg 1.4.12, bind 9.9.6-P2 `[2] <https://kb.isc.org/article/AA-01235>`__ (CVE-2015-1349),
|
|
php 5.6.6 `[3] <https://php.net/ChangeLog-5.php#5.6.6>`__ (CVE-2015-0273), syslogd 10.1
|
|
* Fixed wizard default settings and reload/redirect
|
|
* DNS forwarder now properly reloads on host overrides updates
|
|
* IPFW ruleset reload fix after start/restart of captive portal
|
|
* Page contents upload and MIME type for svg images fix in captive portal
|
|
* IPsec/Strongswan now supports IKEv1
|
|
* Basic plumbing for the MVC framework has been completed
|
|
* Fix Copy my MAC address in DHCP service editor
|
|
* Removed IPv6 fcgi-fpm leftovers
|
|
* Assorted fixes regarding menus, page titles and links
|
|
|
|
Change Log 15.1.6.1:
|
|
|
|
* Don't clobber user and group settings when running opnsense-update.
|
|
Caused e.g. dhcpd to refuse operation.
|
|
* Fix a regression that would prevent e.g. sshd from starting.
|
|
* Install opnsense-update by default.
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.5 (February 10, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
We shifted the release back a couple of days to discuss current progress and
|
|
the feedback we've gotten and directly review the release process -- it seems
|
|
to be "clean enough". ;)
|
|
|
|
We've updated the bug trackers, added a couple of wiki pages and related
|
|
articles with more on roadmap refinement on the way in a day or two. Thank
|
|
you for all the responses and kind mentions.
|
|
|
|
This is a typical maintenance release with ports stable updates and various
|
|
core fixes. On the other hand, we are putting a new MVC-based framework in
|
|
place to slowly replace the current front end scripting (yep, this is a
|
|
request for comments). Here is the full list of changes:
|
|
|
|
* Removed a spurious user-agent check to restore mobile device support.
|
|
* Fixed pop-up window handling for LDAP configuration.
|
|
* Fixed several minor GUI bugs in firewall rules and system pages.
|
|
* Grab the correct OpenSSL from the system for encrypting/decrypting the
|
|
configuration files.
|
|
* Message of the day now shows the correct system version.
|
|
* Fixed sorting and button for deleting selected rules in NAT pages.
|
|
* Notable ports updates: pkg 1.4.10, gettext 0.19.4, libzmq 4.0.5,
|
|
ntp 4.2.8p1, ca_root_nss 3.17.4, libsodium 1.0.2
|
|
* Groundwork on the MVC-based GUI replacement including examples. This does
|
|
not affect the current GUI.
|
|
|
|
All upgrade methods are viable. The images can be found here:
|
|
|
|
https://sourceforge.net/projects/opnsense/files/15.1.5/
|
|
|
|
Upgrade responsibly (swiftly that is),
|
|
The OPNsense team
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.4 (January 31, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
So this has been January: an interview on BSDnow, amd64 and i386 images,
|
|
+150 followers on Twitter, +3000 downloads and five releases. Yes, five.
|
|
We proudly announce our next stable cut: It has been quite calm on the ports
|
|
side of things, but there have been many commits in the core adding up to an
|
|
incentive to upgrade as soon as possible. And, yes, there are patches
|
|
addressing CVEs in FreeBSD. Here is the change log:
|
|
|
|
* FreeBSD-SA-15:02.kmem `[1] <https://www.freebsd.org/security/advisories/FreeBSD-SA-15:02.kmem.asc>`__ (CVE-2014-8612)
|
|
* FreeBSD-SA-15:03.sctp `[2] <https://www.freebsd.org/security/advisories/FreeBSD-SA-15:03.sctp.asc>`__ (CVE-2014-8613)
|
|
* time zone data updated to 2015a `[2] <https://www.freebsd.org/security/advisories/FreeBSD-SA-15:03.sctp.asc>`__
|
|
* sshd now uses the correct OpenSSH version
|
|
* fixed SSL certificate generation issue
|
|
* interfaces, unbound, certificates and NAT GUI fixes
|
|
* captive portal voucher key regeneration and OpenSSL usage fixed
|
|
|
|
The images can be found here:
|
|
|
|
https://sourceforge.net/projects/opnsense/files/15.1.4/
|
|
|
|
The advised upgrade method is to boot from install media, recover your
|
|
device configuration using the import configuration option, then do a
|
|
quick/easy install (or a custom one if you did that previously).
|
|
|
|
Please note that the current firmware upgrade does \*not\* update the kernel and
|
|
base system to fix the FreeBSD security advisories. We are actively working on
|
|
a solution which also includes discussing using pkgng as the system for such
|
|
tasks in the future.
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.3 (January 24, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
This week we took PHP's stable update `[1] <https://php.net/ChangeLog-5.php#5.6.5>`__ as a subtle hint to release another
|
|
stable cut. Here are the most prominent changes:
|
|
|
|
* notable package upgrades: php 5.6.5 and friends, pkg 1.4.7
|
|
* added a dropdown searchbox for interfaces in rules screen
|
|
* fixed the missing theme issue when importing older configurations
|
|
* fixed a bug with the user manager
|
|
* firmware upgrades stabilisation pass
|
|
* various bootstrap enhancements
|
|
|
|
Firmware upgrade via the GUI is feasible, images can be found here as well:
|
|
|
|
https://sourceforge.net/projects/opnsense/files/
|
|
|
|
We are actively looking for feedback of your upgrade experiences.
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.2 (January 18, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
Some of you have been wondering; now wonder no more: the next stable release
|
|
is here. From the changelog:
|
|
|
|
* firmware upgrade experience improvements
|
|
* FreeBSD SA-15:01 with multiple OpenSSL fixes
|
|
* OpenSSL from ports now brings you the latest and greatest 1.0.1l
|
|
* pkg 1.4.6 hot off the press
|
|
|
|
The images can be found here: https://sourceforge.net/projects/opnsense/files/
|
|
|
|
This is mostly motivated by the latest OpenSSL issues, although I must say we
|
|
work on giving LibreSSL a chance soon and make a final decision about the
|
|
library that we are going to stick to from 15.7 on. Any help here is
|
|
appreciated. :)
|
|
|
|
Recommended ways of upgrade:
|
|
|
|
Upgrade via the GUI, make sure you restart the box so that no service will
|
|
run on vulnerable binaries. The base OpenSSL will \*not\* be updated at this
|
|
point, so if you don't fully trust the port just yet try the second method.
|
|
|
|
Or:
|
|
|
|
Take your favourite image, boot up the device or VM with the new install
|
|
image. In the installer, choose "Import Configuration" and if all is well,
|
|
continue with the Easy/Quick install. This way makes sure all of the base
|
|
system is replaced.
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1.1 (January 12, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
First of all we are grateful for the successful launch of OPNsense. Thank
|
|
you all for the enthusiastic reactions and support! We appreciate your
|
|
feedback and if you want to help out with testing, coding or documentation
|
|
you are invited to do so. Let's make OPNsense the best open source firewall
|
|
together.
|
|
|
|
To fix some bugs we release the OPNsense version 15.1.1 as an intermediate
|
|
patch release. Here is the full changelog:
|
|
|
|
* i386 images added
|
|
* added architecture awareness to the build system
|
|
* ports updated: pkg 1.4.4, strongswan 5.2.2, libssh2 1.4.3_5,2,
|
|
libffi 3.2.1, libevent2 2.0.22, freetype2 2.5.5, curl 7.40.0,
|
|
bind99 9.9.6P1_3
|
|
* Added template engine for new features
|
|
* Several bug fixes and enhancements `[2] <https://github.com/opnsense/core/issues>`__ (#6, #7, #8, #9, #17, #19, #20, #21,
|
|
#22, #23)
|
|
|
|
Download `[1] <http://opnsense.org/download/>`__ and use it now!
|
|
|
|
Because Open makes Sense!
|
|
|
|
--------------------------------------------------------------------------
|
|
15.1 (January 02, 2015)
|
|
--------------------------------------------------------------------------
|
|
|
|
The OPNsense core team is proud to announce that it has released its 15.1
|
|
version, nicknamed "Ascending Albatross", of the open source OPNsense
|
|
firewall software.
|
|
|
|
This is the first release by the OPNsense project. Download `[1] <http://opnsense.org/download/>`__ and try it now!
|
|
Be sure to visit the project website `[2] <http://www.opnsense.org/>`__ and learn more about us and the
|
|
project. The project wants to be a friendly place for users, developers and
|
|
partners.
|
|
|
|
We believe that an open source project should keep its sources and build tools
|
|
available for all. OPNsense uses the simple 2-clause BSD license.
|
|
|
|
Users benefit from the polished installer, rich feature set and modern user
|
|
interface. Developers are invited to check out our easy-to-use build tools.
|
|
Commercial Support assists in keeping networks fast and secure. The project
|
|
welcomes partners to be successful together.
|
|
|
|
OPNsense(r) is based on FreeBSD 10 and is a fork of pfSense(r) which in its
|
|
turn is a fork of m0n0wall(r).
|
|
|
|
The next major release is 15.7 and is to be released on July 1st 2015. Bug
|
|
fixes and security patches will be released when available.
|
|
|
|
We are looking forward to welcome you in the OPNsense community.
|
|
|
|
Because Open makes Sense!
|