Netgate Nexus

[ZTE] pfnet-controller consumes 170-180% CPU on Netgate 6100 with Zero Trust Egress enabled

phil_socket95 — Thu, 10 Sep 2026 01:41:58 GMT

@mr_nets said: Summary Enabling Zero Trust Egress (ZTE) causes sustained high CPU usage by pfnet-controller on a Netgate 6100 running pfSense Plus 26.07. The issue is reproducible: disabling ZTE causes the CPU usage of the same pfnet-controller process to drop from approximately 180% to approximately 20%. Thanks for the very complete write-up, that makes it a lot easier to route. The clean ON/OFF correlation is the important bit here, especially with the same long-running pfnet-controller process dropping immediately when ZTE is disabled. The RSS value is also worth paying attention to, 2.5 GB is not something I’d hand-wave away as “normal background work”. If you can, please open a TAC case and include the top -aSH output with ZTE enabled and disabled, pfnet-controller logs around the toggle, and a sanitized ZTE config. I’d also avoid repeatedly killing the process unless support asks, since the “no reboot required” behavior is useful evidence. In the meantime, leaving ZTE disabled is the sane workaround, unless you enjoy using the 6100 as a small space heater.

IPv6 Invalid range?

SteveITS — Sat, 05 Sep 2026 14:57:07 GMT

@Gertjan OK so then it's likely a "feature" that they block it if it's not the configured static subnet. Annoying in my very specific case but not a big issue.

Netgate Nexus coreDNS fails to start on Boot / Reboot

felixm223pfsense — Thu, 03 Sep 2026 15:13:57 GMT

Netgate device: SG2100
Version: 26.07

With the release of 26.07 and coreDNS I was eager to try ZTE. Before I use it on my SG 6100 I wanted to test with my SG2100.

I have been working now for several days and I have failed to get ZTE working. Im trouble shooting first thing I noticed is that coreDNS service fails to start on system reboot and has to be started manually.

Steps taken so far to resolve this.

Factory rest the SG2100 - I noticed that this doesn't appear to reset the Nexus config and as such doesn't reset the coreDNS config. In an attempt to reset the Nexus config I disabled it and reinstalled it, this too fails to reset the config or at least the old logs are still there. I looked through this forum as well as Netgate's documentation site and was unable to find a documented procedure on how to rest Nexus.
Reinstall pfSense+ - Next I went through the process of getting the installer, wiping the ssd and reinstalling pfSense 26.07, fearing that there may have been artifacts from the last ver of pfSense +. To that end with just going through the pfSense + Setup Wizard, Enabling Nexus, changing the port on Unbound, and enabling coreDNS with its wizard it still fails to start after reboot.

I'm happy to supply logs to help troubleshoot I just need to know which ones and at what level.

Mike

CoreDNS / ZTE - Can it do allow list only for domains and block everything else?

Jim Coogan — Tue, 01 Sep 2026 21:08:47 GMT

@jimp Thanks for the reply and looking into this. Messed around with this some more and it seems the key is that on the CoreDNS group for restricted clients you have to not define a DNS server. That way only the domains under FW get resolved. Otherwise if the group has a specified DNS server than everything gets resolved that isn't explicitly blocked. With this setup I also do not need to rely on the fallback to default. However, I have only been able to prove this from a DNS resolution standpoint because for some reason it seems like the traffic is not getting tagged with coredns_allow because my corresponding firewall rule for allowing the traffic does not match and I have checked it 5 times to ensure the rule is correct. It is basically allow TCP/UDP ANY ANY ANY ANY tagged:coredns_allow on the interface of the client in question. ZERO TRUST EGRESS is enabled and the client can only resolve the domains I put in group forward section and the IPs I get from a dig are exactly the same that curl then tries in my test. @264 pass in log quick on igc2.60 inet proto tcp from 192.168.77.41 to any flags S/SA keep state (if-bound) label "id=1788994054" label "tags=user_rule" label "descr=[COREDNS] allow coredns allowed internet hosts" ridentifier 1788994054 tagged coredns_allow Ultimately the firewall logs for the test traffic show it match for default deny on the interface. Seems to be quite similar to issue reported here https://forum.netgate.com/topic/201102/zero-trust-egress-with-coredns-can-t-get-it-working/ On another note, I had not fully considered one downside of using coreDNS allow listing like this which is that inheirently the firewall rules have to allow anything tagged coredns_allow so all clients subject to this, at least within the same group, end up being allowed to access all of the same domains. Not the end of the world, but I guess what Im really looking for as a feature request is CoreDNS backed aliases that could be used in firewall rules which hopefully this lays the ground work for someday. In the meantime I am still curious to get the tagged allow rules working like they are supposed to now. Running 26.07-RELEASE (amd64) on Netgate 4200.

Nexus UI BUG - Diagnostics -> DNS Lookups

felixm223pfsense — Tue, 01 Sep 2026 13:05:47 GMT

While working to implement coreDNS I found a bug in the Nexus UI, Diagnostics -> DNS Lookup

One of my Internal DNS servers was not responding and this was causing the DNS Lookup tool to crash.

When the tool is run from the old interface it runs correctly and shows that the one server was not responding.

Also running from the Command Prompt or via SSH runs correctly.

After restoring the DNS service the tool once again works fine.

System: Netgate 6100
Version: 26.07-RELEASE

Best regards,
Mike

WOL Missing in Services

willcycle — Mon, 31 Aug 2026 11:46:10 GMT

I posted to the wrong forum initially.

Concerns about Nexus as the future default GUI

SteveITS — Sat, 29 Aug 2026 07:58:15 GMT

@keyser There’s a Nexus category on redmine

No Nexus dashboard widget for services??!!

tkerr — Sun, 23 Aug 2026 14:30:03 GMT

@beerguzzle The services widget is coming soon (like a few days soon)! In the meantime you can go to Status -> Services to check. It looks like CoreDNS doesn't get a status so I will make a ticket to track that

Threatgate or ThreatGate?

tinfoilmatt — Sat, 22 Aug 2026 17:30:36 GMT

Damn it, George!

pfBlockerng->Threatgate migration, how to?

JeGr — Sat, 22 Aug 2026 16:34:08 GMT

@beerguzzle said in pfBlockerng->Threatgate migration, how to?: I would further argue that Nexus itself isn't ready yet, just because of the lack of a complete Dashboard widget set. If I wanted to use Nexus for just for remote management, I would want it to display the same or equivalent Dashboard remotely as what I would see from the PHP Dashboard when logged on locally. It can't even do that. Sheesh. You'd hear no argue against that from me. Missing dashboard overview stuff like widgets, status displays etc. is only icing on the cake really. For us it even starts below that with boxes that are licensed or paying TAC lite for running plus now unable to access all functionality of Nexus just because of some random serial number field not set up or running in a VM on a non-silicon-valley-cloud is getting really strange.

Error on every login: "session invalid, reauthenticate" (Nexus)

luckman212 — Fri, 21 Aug 2026 12:45:55 GMT

Not sure if this got posted somewhere else before (I did a quick search and didn't find it)...

pfSense+ 26.07 + Nexus 577a04a4dbd76f67a0ce230b71a293e90bb31666

Every time I log into my Nexus instance, there's an error indicated on the left nav bar that says: "session invalid, reauthenticate (no token present in request)"

screenshot:

This is just a mild nuisance since I have to clear it every time or my OCD is triggered.

Not sure this "error" should trigger a red notification like that, a message in the log would be enough imo...

Migration of Settings to New UI

applesalwaysred — Thu, 20 Aug 2026 16:28:06 GMT

Hi, tried the new ui and noticed that the admin account which was disabled, was enabled under new ui. Also, maxmind license had to be manually updated and dns info was empty. Is there a migration script missing on the update? Btw miss the little help dialogues that exist on the old ui.
Thanks

Netgate Nexus is not supported on this sytem

Bob.Dig — Tue, 18 Aug 2026 06:25:30 GMT

Netgate Nexus is not supported on this sytem
400 Netgate Nexus is not supported on this sytem

Nexus cannot be licensed on this system due to: serial number unavailable, unsupported virtualization.

Oracle Cloud Infrastructure

On the dashboard, the localhost pfSense is not available.

Unable to clear "Apply Changes" for "pkg"

KevinRice — Mon, 17 Aug 2026 17:18:03 GMT

This prompt continues to re-appear no matter how many times I "Apply Changes":

What can I do to determine the offending problem and rectify it?

Kind thanks.

v26.07/Netgate Nexus/SG-5100

Nexus login page not recognized by Proton Pass password manager

KevinRice — Mon, 17 Aug 2026 17:14:38 GMT

@johnpoz I'm kinda out of ideas. Definitely a Proton issue—which is rare, but there's a few sites that give troubles.

I think I missed something; Nexus Authentication

mattyC — Fri, 14 Aug 2026 17:47:14 GMT

I get this exact same issue - did you find a resolution?

Disabling Nexus changes /cf/conf/config.xml permissions, breaks config.xml scp-only access

marcg — Tue, 11 Aug 2026 19:34:15 GMT

As a workaround, I installed the "cron" package and created a job to reset the permissions of config.xml just prior to scheduled nightly scp backups.

26.07 RC memory leak?

mcury — Sat, 08 Aug 2026 14:35:57 GMT

@marcosm said in 26.07 RC memory leak?: How soon does it reach that amount after restarting the service? After about 17 to 19 hours, a memory issue occurs. Despite seeming pretty stable, it gradually starts to leak RAM. Does it still happen with ThreatGate disabled? I haven't tested it with ThreatGate disabled yet, so I can't say for sure. A little more about my setup:In CoreDNS, I'm using 3 groups with fallback.In these groups, I have a few forwards and resolvers.CoreDNS is forwarding to DNS resolver 127.0.0.1:5353 because I'm using DNS-over-TLS to Cloudflare.ThreatGate is enabled, but it is only using the GeoIP MaxMind feed, nothing else yet.

A lot of "reserved IP" traffic going out on WAN while Nexus is enabled

Bob.Dig — Sat, 08 Aug 2026 07:11:58 GMT

@marcosm said in A lot of "reserved IP" traffic going out on WAN while Nexus is enabled: We'll work on fixing that. Great. There are a few connections to 169.254.169.254 over the day, even if Nexus is disabled.

Non-Netgate hardware?

luckman212 — Fri, 07 Aug 2026 14:45:41 GMT

I'm using a Protectli currently while I wait for Netgate's next mid-range appliance. Nexus seems to be running fine for me. I'm not using ThreatGate yet.

Group Map in SAML provider config can't be saved, not even with the default {} value.

tkerr — Fri, 07 Aug 2026 11:21:57 GMT

@fwit I can replicate this bug. We'll get it fixed

SAML providers can't be deleted.

fwit — Fri, 07 Aug 2026 11:18:48 GMT

Does no one have the same problem? Is the bug known?

ThreatGate DB - pfnet-controller WARN No rules found

mcury — Thu, 06 Aug 2026 17:52:18 GMT

ThreatDB is downloading the MaxMind lists, and you can use them as aliases in firewall rules. However, the rule is not matching packets. I have opened a Redmine ticket: #17027

Detailed understanding of "Zero trust Egress"

keyser — Thu, 06 Aug 2026 14:03:13 GMT

@tinfoilmatt I agree and I have read them. I would just like to know how it has been implemented in the back so I can make an educated guess on performance. I’m mostly worried about the thousands of lists of resolved IPs CoreDNS needs to maintain (one for each client), and the risk of the client attempting to pass correctly resolved traffic before CoreDNS and pfFilter is updated with the correct list of resolved IP’s for that client.

CRITICAL! - No logging available for CoreDNS queries/responses

jackdan — Thu, 06 Aug 2026 13:30:53 GMT

@keyser me too, this is one of the first thing I was looking for :-(, not ready for my use then.