![\"pfSense\"](\"https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardware-pfSense-sistema-operativo.png\")
pfSense\u00ae<\/strong>\u00a0is a free distribution based on\u00a0FreeBSD open-source<\/strong>, customized to be a\u00a0firewall<\/strong>\u00a0and\u00a0router<\/strong>. Besides being a powerful\u00a0firewall<\/strong>\u00a0and\u00a0router<\/strong>\u00a0platform, it includes a long list of packages that allow you to easily expand the functionality without compromising system security.JTVCYWRyb3RhdGUlMjBiYW5uZXIlM0QlMjIzJTIyJTVE<\/p>\nSecurity \/ Errata<\/h3>\n
[vc_separator align=”align_left” border_width=”2″ css=”.vc_custom_1522327747370{margin-top: -20px !important;}”]<\/p>\n
- \n
- FreeBSD-SA-18:01.ipsec<\/a><\/li>\n
- Kernel PTI mitigations for Meltdown (optional tunable)\u00a0FreeBSD-SA-18:03.speculative_execution.asc<\/a><\/li>\n
- IBRS mitigation for Spectre V2 (requires updated CPU microcode)\u00a0FreeBSD-SA-18:03.speculative_execution.asc<\/a><\/li>\n
- Added a CPU Microcode update mechanism (cpuctl module, sysutils\/devcpu-data port)<\/li>\n
- Imported a FreeBSD patch to fix boot issues when running as a hypervisor guest on AMD Family 15h processors (FreeBSD PR #213155<\/a>)<\/li>\n
- Added validation for RRD parameters to ensure passed filenames are valid\u00a0#8269<\/a><\/li>\n
- Fixed a potential XSS vector in RRD error output encoding\u00a0#8269<\/a>\u00a0pfSense-SA-18_01.packages<\/a><\/li>\n
- Fixed a potential XSS vector in diag_system_activity.php output encoding\u00a0#8300<\/a>\u00a0pfSense-SA-18_02.webgui<\/a><\/li>\n
- Fixed a potential XSS vector in traffic_graphs.widget.php settings\u00a0#8302<\/a>\u00a0pfSense-SA-18_03.webgui<\/a><\/li>\n
- Fixed a potential CSRF issue in service control request processing\u00a0#8296<\/a><\/li>\n
- Enabled CSRF protection for all dashboard widgets\u00a0#8301<\/a><\/li>\n
- Added encoding for firewall schedule range descriptions\u00a0#8259<\/a><\/li>\n
- Changed sshd to use delayed compression\u00a0#8245<\/a><\/li>\n
- Increased PHP-FPM resources on systems with over 1GB RAM to improve performance\u00a0#8125<\/a><\/li>\n
- Imported a netstat fix for ARM platforms to improve performance and reduce CPU usage, especially on the Dashboard\u00a0#8237<\/a><\/li>\n
- Fixed a memory leak in the pfSense_getall_interface_addresses() function in the pfSense PHP module\u00a0#8249<\/a><\/li>\n
- Hardware support for the XG-7100, including:\n
- \n
- C3000 NIC support (factory installations only)<\/li>\n
- C3000 SoC support (factory installations only)<\/li>\n
- Marvell 88E6190 switch support (factory installations only)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Traffic Shaping \/ Limiters<\/h3>\n
[vc_separator align=”align_left” border_width=”2″ css=”.vc_custom_1522327747370{margin-top: -20px !important;}”]<\/p>\n
- \n
- Fixed hangs due to Limiters and pfsync in HA\u00a0#4310<\/a><\/li>\n
- Added the Chelsio\u00a0cxl<\/em>\u00a0driver to the list of ALTQ capable interfaces\u00a0#7607<\/a><\/li>\n
- Fixed an issue with limiters that had fractional bandwidth values\u00a0#8091<\/a><\/li>\n
- Changed status_queues.php to provide \u2018realtime\u2019 statistics\u00a0#8185<\/a><\/li>\n<\/ul>\n
IPsec<\/h3>\n
[vc_separator align=”align_left” border_width=”2″ css=”.vc_custom_1522327747370{margin-top: -20px !important;}”]<\/p>\n
- \n
- Changed IPsec Phase 1 to allow selecting both IPv4 and IPv6 so the local side can allow inbound connections to either address family\u00a0#6886<\/a><\/li>\n
- Changed IPsec Phase 1 to allow configuration of multiple IKE encryption algorithms, key lengths, hashes, and DH groups\u00a0#8186<\/a><\/li>\n
- Fixed a problem when IPsec bypasslan was enabled while the LAN interface is disabled or doesn\u2019t have an IP address\u00a0#8239<\/a><\/li>\n
- Added IPv6 LAN Network to the IPsec LAN bypass list\u00a0#8321<\/a><\/li>\n<\/ul>\n
OpenVPN<\/h3>\n
[vc_separator align=”align_left” border_width=”2″ css=”.vc_custom_1522327747370{margin-top: -20px !important;}”]<\/p>\n
- \n
- Fixed an error message encountered by a few users when manually killing OpenVPN connections\u00a0#8266<\/a><\/li>\n
- Added an OpenVPN tap bridge configuration option to push the bridged interface address to clients as a route-gateway for routes\/redirects\u00a0#8267<\/a><\/li>\n
- Added an option to the DNS Resolver which allows registering the CN of OpenVPN clients as hostnames\u00a0#6847<\/a><\/li>\n
- Added an option to OpenVPN clients and servers to suppress creation of IPv4 or IPv6 gateway addresses for an interface\u00a0#6848<\/a><\/li>\n
- Fixed issues with OpenVPN when using a \/31 IPv4 Tunnel Network\u00a0#8261<\/a><\/li>\n
- Updated the OpenVPN wizard with the current UDP and TCP protocol selections\u00a0#8298<\/a><\/li>\n
- Added the interface for a VPN to the OpenVPN client and server list screens<\/li>\n<\/ul>\n
Notifications<\/h3>\n
[vc_separator align=”align_left” border_width=”2″ css=”.vc_custom_1522327747370{margin-top: -20px !important;}”]<\/p>\n
- \n
- Changed SMTP notifications handling so they are batched, to avoid sending multiple e-mail messages in a short amount of time\u00a0#4031<\/a><\/li>\n
- Added a notification when the firewall boot sequence is complete\u00a0#7643<\/a><\/li>\n<\/ul>\n
Dashboard<\/h3>\n
[vc_separator align=”align_left” border_width=”2″ css=”.vc_custom_1522327747370{margin-top: -20px !important;}”]<\/p>\n
- \n
- Fixed issues with the IPsec dashboard widget causes GUI failure\u00a0#6318<\/a><\/li>\n
- Changed the Dynamic DNS Widget so it shows the description of custom entries to identify them\u00a0#7843<\/a><\/li>\n
- Fixed a reference to deprecated updateGatewayDisplays() function in the Gateways dashboard widget\u00a0#8303<\/a><\/li>\n
- Added a setting to the temperature widget to display readings in Fahrenheit\u00a08205<\/a><\/li>\n
- Changed the picture widget so the picture is stored on the firewall filesystem and not in config.xml to reduce the size of backup data\u00a0#8371<\/a>\n
- \n
- On upgrade, pictures will be moved out of config.xml, so backup this file separately if it is important<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
DHCP<\/h3>\n
[vc_separator align=”align_left” border_width=”2″ css=”.vc_custom_1522327747370{margin-top: -20px !important;}”]<\/p>\n
- \n
- Added an option to the DHCP Server Dynamic DNS configuration to set the server key algorithm\u00a0#6621<\/a><\/li>\n
- Added DDNS Client Updates option to DHCPv4\u00a0#7131<\/a><\/li>\n
- Fixed handling of the DHCPv6 DDNS reverse zone key\u00a0#6319<\/a><\/li>\n
- Fixed DHCPv4 static mappings so that multiple MAC for same DHCP address or hostname are allowed\u00a0#8220<\/a><\/li>\n
- Fixed a potential issue in detecting primary\/secondary node in a failover configuration<\/li>\n
- Improved DHCP relay destination interface discovery<\/li>\n
- Fixed DHCPv6 lease display for entries that were not parsed properly from the lease database#7413<\/a><\/li>\n<\/ul>\n
Dynamic DNS<\/h3>\n
[vc_separator align=”align_left” border_width=”2″ css=”.vc_custom_1522327747370{margin-top: -20px !important;}”]<\/p>\n
- \n
- Added an option for RFC 2136 Dynamic DNS server key algorithm\u00a0#8244<\/a><\/li>\n
- Added an option for RFC 2136 source address used to send updates\u00a0#8278<\/a><\/li>\n
- Fixed issues with Dynamic DNS updates using a gateway group when the primary route is down#8333<\/a><\/li>\n
- Added GoDaddy Dynamic DNS provider<\/li>\n<\/ul>\n
Interfaces \/ VIPs<\/h3>\n
[vc_separator align=”align_left” border_width=”2″ css=”.vc_custom_1522327747370{margin-top: -20px !important;}”]<\/p>\n
- \n
- Fixed issues on assign_interfaces.php with large numbers of interfaces\u00a0#6400<\/a><\/li>\n
- Fixed handling of CARP VIPs on disabled interfaces at boot time\u00a0#6677<\/a><\/li>\n
- Fixed issues with radvd being enabled on a disconnected interface\u00a0#6974<\/a><\/li>\n
- Fixed issues with rtsold on VLAN interfaces\u00a0#7412<\/a><\/li>\n
- Fixed issues with dhcp6c lock files after unclean shutdown when using \u201cDo not wait for an RA\u201d on IPv6 WAN interface\u00a0#8106<\/a><\/li>\n
- Added a feature to allow pppoe on a CARP VIP so it will only be active on whichever node is master\u00a0#8184<\/a><\/li>\n
- Fixed an error when editing PPP interfaces on a system with no VIPs\u00a0#8322<\/a><\/li>\n
- Added VLAN priority tagging for DHCPv6 client requests\u00a0#8200<\/a><\/li>\n
- Added support for configuring the DUID type for an IPv6 interfaces\u00a0#8191<\/a><\/li>\n
- Allow custom INIT string for PPP modem SIM Pin and APN settings<\/li>\n
- Added an indicator for disabled interfaces on status_interfaces.php<\/li>\n
- Fixed an issue with the PPP linkup and linkdown scripts and cellular modems<\/li>\n
- Fixed an issue where the combination of CARP with bridging could lead to a deadlock\u00a0#8056<\/a><\/li>\n<\/ul>\n
Packages<\/h3>\n
[vc_separator align=”align_left” border_width=”2″ css=”.vc_custom_1522327747370{margin-top: -20px !important;}”]<\/p>\n
- \n
- Fixed reinstall process for missing packages\u00a0#8183<\/a><\/li>\n<\/ul>\n
Captive Portal<\/h3>\n
[vc_separator align=”align_left” border_width=”2″ css=”.vc_custom_1522327747370{margin-top: -20px !important;}”]<\/p>\n
- \n
- Fixed Pass-through MAC automatic additions so it does not add duplicate entries\u00a0#8226<\/a><\/li>\n
- Fixed a missing global definition in Captive Portal pass-through MAC removal\u00a0#8238<\/a><\/li>\n
- Fixed Captive Portal voucher sync errors when vouchers are expired or disconnected while the secondary node is master\u00a0#8317<\/a><\/li>\n
- Fixed Captive Portal voucher synchronization between HA nodes\u00a0#7972<\/a><\/li>\n<\/ul>\n
Certificates<\/h3>\n
[vc_separator align=”align_left” border_width=”2″ css=”.vc_custom_1522327747370{margin-top: -20px !important;}”]<\/p>\n
- \n
- Fixed automatic SAN handling when the CN of a certificate contains a space\u00a0#8252<\/a><\/li>\n
- Fixed input validation for Certificate SAN values to disallow IP addresses for FQDN\/Hostname entries\u00a0#8275<\/a><\/li>\n<\/ul>\n
Gateways\/Routing<\/h3>\n
[vc_separator align=”align_left” border_width=”2″ css=”.vc_custom_1522327747370{margin-top: -20px !important;}”]<\/p>\n
- \n
- Fixed handling of the Router Lifetime value on services_router_advertisements.php so it allows a value of\u00a00<\/em>\u00a0#7502<\/a><\/li>\n
- Added ospf6d to the routing log<\/li>\n
- Allow recursive aliases to be used with static routes<\/li>\n<\/ul>\n
Rules\/NAT<\/h3>\n
[vc_separator align=”align_left” border_width=”2″ css=”.vc_custom_1522327747370{margin-top: -20px !important;}”]<\/p>\n
- \n
- Fixed various pf \u201cbusy\u201d errors when the ruleset is reloaded<\/li>\n
- Fixed issues with editing firewall rules in non-English languages that contain single quotes in translated strings\u00a0#8219<\/a><\/li>\n
- Added an option to disable drag-and-drop of firewall and NAT rules<\/li>\n
- Added a check to prevent 1:1 NAT rules with missing information from being added to the ruleset<\/li>\n
- Added firewall rule tracking ID to rule list (in counter tooltip) and firewall rule edit page\u00a0#8348<\/a><\/li>\n
- Fixed cases where automatic or scripted rules were not getting tracking IDs\u00a0#8353<\/a><\/li>\n
- Added a check to prevent automatic outbound firewall rules with missing information from being added to the ruleset\u00a0#8360<\/a><\/li>\n<\/ul>\n
Users\/Authentication<\/h3>\n
[vc_separator align=”align_left” border_width=”2″ css=”.vc_custom_1522327747370{margin-top: -20px !important;}”]<\/p>\n
- \n
- Fixed issues with XMLRPC user account synchronization causing GUI inaccessibility on secondary HA nodes\u00a0#7469<\/a><\/li>\n
- Fixed an issue where a user with no privileges could not logout\u00a0#8297<\/a><\/li>\n
- Increased maximum username length from 16 to 32 characters to catch up to the current allowed length in FreeBSD<\/li>\n
- Fixed required field markings on LDAP authentication server configuration fields\u00a0#8337<\/a><\/li>\n
- Fixed display of the LDAP host when testing the GUI authentication source\u00a0#8338<\/a><\/li>\n<\/ul>\n
Misc<\/h3>\n
[vc_separator align=”align_left” border_width=”2″ css=”.vc_custom_1522327747370{margin-top: -20px !important;}”]<\/p>\n
- \n
- Fixed NTP Status server time for zones with minute offsets (fractions of an hour)\u00a0#8129<\/a><\/li>\n
- Added support for custom shutdown scripts in \/usr\/local\/etc\/rc.d\u00a0#8182<\/a><\/li>\n
- Fixed a references to an undefined function while restoring a config.xml file from an older version\u00a0#8231<\/a><\/li>\n
- Added support to diag_packet_capture.php to capture traffic on the loopback interface\u00a0#8257<\/a><\/li>\n
- Fixed an issue with the RAM disk warning pop-up appearing when no changes were made\u00a0#8268<\/a><\/li>\n
- Fixed an issue with the address familiy selection for remote syslog servers using IPv6\u00a0#8323<\/a><\/li>\n
- Silenced warnings from sysctl that otherwise went to stderr<\/li>\n
- Added a disk size check to ZFS to prevent it from being used on disk which are too small to contain the OS and swap space\u00a0#7308<\/a><\/li>\n
- Added a check to prevent pfSense-upgrade from running as a non-root user\u00a0#7762<\/a><\/li>\n
- Added an option to disable the IGMP Proxy service\u00a0#8356<\/a><\/li>\n
- Fixed an issue with package handling when restoring a configuration that contains a branch configuration that is not valid for the target system version\u00a0#8208<\/a><\/li>\n<\/ul>\n
[\/vc_column][vc_column width=”1\/3″][vc_tta_accordion c_icon=”” active_section=”1″][vc_tta_section i_icon_fontawesome=”fa fa-check” add_icon=”true” title=”All versions” tab_id=”1e176-0b7ea534-a5bf969a-50a5eeb3-efc9feab-68870c33-53871b11-7d9282fb-01217f37-1de25693-9e60b4fe-5de8″]<\/p>\n
- \n
- pfSense\u00ae CE 2.5.0 Beta<\/a><\/li>\n
- pfSense\u00ae CE 2.4.3: release notes<\/a><\/li>\n
- pfSense\u00ae CE 2.4.2: release notes<\/a><\/li>\n
- pfSense\u00ae CE 2.4.1: release notes<\/a><\/li>\n
- pfSense\u00ae CE 2.4: release notes<\/a><\/li>\n
- pfSense\u00ae CE 2.3.3: release notes<\/a><\/li>\n
- pfSense\u00ae CE 2.3.2: release notes<\/a><\/li>\n
- pfSense\u00ae CE 2.3.1: release notes<\/a><\/li>\n
- pfSense\u00ae CE 2.3: release notes<\/a><\/li>\n
- pfSense\u00ae CE 2.2.5: release notes<\/a><\/li>\n
- pfSense\u00ae CE 2.2: release notes<\/a><\/li>\n
- pfSense\u00ae CE 2.1.5: release notes<\/a><\/li>\n
- pfSense\u00ae CE 2.1.4: release notes<\/a><\/li>\n
- pfSense\u00ae CE 2.1.3: release notes<\/a><\/li>\n
- pfSense\u00ae CE 2.1.2: release notes<\/a><\/li>\n
- pfSense\u00ae CE 2.1.1: release notes<\/a><\/li>\n
- pfSense\u00ae CE 2.1: release notes<\/a><\/li>\n
- pfSense\u00ae CE 2.0.3: release notes<\/a><\/li>\n
- pfSense\u00ae CE 2.0.2: release notes<\/a><\/li>\n
- pfSense\u00ae CE 2.0.1: release notes<\/a><\/li>\n
- Main features<\/a><\/li>\n<\/ul>\n
[\/vc_tta_section][vc_tta_section i_icon_fontawesome=”fa fa-external-link” add_icon=”true” title=”Link utili” tab_id=”2e176-0b7ea534-a5bf969a-50a5eeb3-efc9feab-68870c33-53871b11-7d9282fb-01217f37-1de25693-9e60b4fe-5de8″]<\/p>\n
- pfSense\u00ae CE 2.4.3: release notes<\/a><\/li>\n
- Added support for custom shutdown scripts in \/usr\/local\/etc\/rc.d\u00a0#8182<\/a><\/li>\n
- Fixed an issue where a user with no privileges could not logout\u00a0#8297<\/a><\/li>\n
- Fixed input validation for Certificate SAN values to disallow IP addresses for FQDN\/Hostname entries\u00a0#8275<\/a><\/li>\n<\/ul>\n
- Fixed a missing global definition in Captive Portal pass-through MAC removal\u00a0#8238<\/a><\/li>\n
- Fixed Pass-through MAC automatic additions so it does not add duplicate entries\u00a0#8226<\/a><\/li>\n
- Fixed handling of CARP VIPs on disabled interfaces at boot time\u00a0#6677<\/a><\/li>\n
- Added an option for RFC 2136 source address used to send updates\u00a0#8278<\/a><\/li>\n
- Added DDNS Client Updates option to DHCPv4\u00a0#7131<\/a><\/li>\n
- Added an option to the DHCP Server Dynamic DNS configuration to set the server key algorithm\u00a0#6621<\/a><\/li>\n
- Changed the Dynamic DNS Widget so it shows the description of custom entries to identify them\u00a0#7843<\/a><\/li>\n
- Added a notification when the firewall boot sequence is complete\u00a0#7643<\/a><\/li>\n<\/ul>\n
- Added an OpenVPN tap bridge configuration option to push the bridged interface address to clients as a route-gateway for routes\/redirects\u00a0#8267<\/a><\/li>\n
- Changed IPsec Phase 1 to allow configuration of multiple IKE encryption algorithms, key lengths, hashes, and DH groups\u00a0#8186<\/a><\/li>\n
- Added the Chelsio\u00a0cxl<\/em>\u00a0driver to the list of ALTQ capable interfaces\u00a0#7607<\/a><\/li>\n
- Fixed hangs due to Limiters and pfsync in HA\u00a0#4310<\/a><\/li>\n
- Kernel PTI mitigations for Meltdown (optional tunable)\u00a0FreeBSD-SA-18:03.speculative_execution.asc<\/a><\/li>\n