pfSense Packages

Chrony package

johnpoz — Wed, 05 Aug 2026 20:13:44 GMT

@dennypage fantastic work as always - but since 26.07 will be ga I would think fairly soon. I am just going to wait til that is out and have moved to it before play with this. But would be up to moving everything to a chrony client if possible - most everything points to chrony running on one of my pis anyway.

pfsense inside Protectli FW6A

ActOfGod — Sun, 19 Jul 2026 00:25:01 GMT

@patient0 thank you for your reply, I was able to install it properly now without installing 2.8.0 version of Pfsense .

dpinger 3.6

JonathanLee — Mon, 08 Jun 2026 17:34:09 GMT

@johnpoz haha GB yes

Cloudflare DDNS: multiple bugs in dyndns.class (2.8.1) — UNKNOWN ERROR, 0.0.0.0 cache, no record create

Gertjan — Sun, 07 Jun 2026 21:13:02 GMT

@keekar said in Cloudflare DDNS: multiple bugs in dyndns.class (2.8.1) — UNKNOWN ERROR, 0.0.0.0 cache, no record create: Bug 1 — base64_decode() corrupts API token if password not stored as base64 There where you set the password, Services > Dynamic DNS > Dynamic DNS Clients > Edit the password is stored in the config using "base64_encode()". I tens to say this password, as most, if not any, are stored encoded with base64_encode(). Why do you think this password is stored 'in clear' in the config ? Is it ? https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/services_dyndns_edit.php#L215

Arpwatch sending notifications for unselected interfaces

mrnb — Thu, 04 Jun 2026 19:20:08 GMT

@dennypage Ohh odd, I'm not very good at troubleshooting this kind of thing. I reached out to TAC Professional support and maybe they can help out. Thanks.

zabbix-agent7 Crashing

neuf_16 — Wed, 29 Apr 2026 19:25:17 GMT

I'm running into an issue across multiple sites where the zabbix-agent7 will 'randomly' crash and not come back.
I haven't made any changes to the Zabbix server items and the issue did not happen on zabbix-agent6.
Wondering if any one else has run into this?

Here are the logs I see every time it crashes.
The "Active check data upload started to fail" errors have always been there which is a potential problem but never had the SIGBUS crash issue before.

86155:20260429:035229.506 Active check data upload started to fail
86155:20260429:035232.798 active check data upload to [zabbixserver-ipv6:10051] is working again
86155:20260429:113810.527 Unable to connect to [zabbixserver-ipv6]:10051 [cannot connect to [[zabbixserver-ipv6]:10051]: connection timed out]
86155:20260429:113810.527 Active check data upload started to fail
86155:20260429:113818.847 Got signal [signal:10(SIGBUS),reason:3,refaddr:0x2795b3]. Crashing ...
86155:20260429:113818.847 ====== Fatal information: ======
86155:20260429:113818.847 program counter not available for this architecture
86155:20260429:113818.847 === Registers: ===
86155:20260429:113818.847 register dump not available for this architecture
86155:20260429:113818.847 === Backtrace: ===
86155:20260429:113818.848 15: 0x269fab  at /usr/local/sbin/zabbix_agentd
86155:20260429:113818.848 14: 0x26a142  at /usr/local/sbin/zabbix_agentd
86155:20260429:113818.848 13: 0x26a9ab  at /usr/local/sbin/zabbix_agentd
86155:20260429:113818.848 12: 0x823b648aa  at /lib/libthr.so.3
86155:20260429:113818.848 11: 0x823b63e6b  at /lib/libthr.so.3
86155:20260429:113818.848 10: 0x82106b2d3  at ???
86155:20260429:113818.848 9: 0x2795b3  at /usr/local/sbin/zabbix_agentd
86155:20260429:113818.848 8: 0x27a2e7  at /usr/local/sbin/zabbix_agentd
86155:20260429:113818.849 7: 0x27a6c3  at /usr/local/sbin/zabbix_agentd
86155:20260429:113818.849 6: 0x24243a  at /usr/local/sbin/zabbix_agentd
86155:20260429:113818.849 5: 0x240f25  at /usr/local/sbin/zabbix_agentd
86155:20260429:113818.849 4: 0x267c3c  at /usr/local/sbin/zabbix_agentd
86155:20260429:113818.849 3: 0x23bc2b  at /usr/local/sbin/zabbix_agentd
86155:20260429:113818.849 2: 0x269c59  at /usr/local/sbin/zabbix_agentd
86155:20260429:113818.849 1: 0x23c550  at /usr/local/sbin/zabbix_agentd
86155:20260429:113818.849 0: 0x8280ec9a5 <__libc_start1+0x145> at /lib/libc.so.7
86155:20260429:113818.849 === Memory map: ===
86155:20260429:113818.849 memory map not available for this platform
86155:20260429:113818.849 ================================
84798:20260429:113818.850 One child process died (PID:86155,exitcode/signal:1). Exiting ...
84798:20260429:113818.852 Zabbix Agent stopped. Zabbix 7.0.6 (revision c1d7a081969).

OpenVPN Client Export package Windows installer updated to 2.7.1

jimp — Mon, 13 Apr 2026 17:10:12 GMT

I updated the Windows installer bundled in the OpenVPN Client Export package to 2.7.1 which is the current version. Should hopefully be a smooth transition. At least in the tests I was able to run it seemed to behave as expected.

No other changes to the package, just the new installers.

The new package is up for Plus 26.03 and CE 2.8.1.

You might need to uninstall the old client on Windows devices before installing the new one to ensure it actually installs the new 2.7.1 version.

There are no packages currently installed & Unable to retrieve package information.

Ricardo-Marquez — Sun, 05 Apr 2026 05:57:13 GMT

@SteveITS Thanks so much, I will try as well Have a good day

Freeradius Time Condition Bug

johnpoz — Sat, 14 Mar 2026 14:40:27 GMT

@TheSurge here is the link https://redmine.pfsense.org/issues/16749 I also chimed in directly on the report.. When they pick it up, I would assume its going to be really low priority.. But hopefully the fix of just checking for valid input will be simple enough to fix.

Freerad eap-tls auth and wpa3 enterprise wifi 7

johnpoz — Sat, 21 Feb 2026 17:21:50 GMT

@nimrod I didn't throw the old ones away ;) Also the reviews I have read the lites, run much cooler even with no fan.. And mine are not under "heavy" load. ;) But will keep all that in mind. In a worse case scenario I could pop up old ones. I most never throw away working tech even older ;) I still have flexhd AP as well my son moved away from when he got fiber in and the isp ap was working fine for him. I got my old unifi gateway he was using that I had sitting around that I had gotten while waiting for my sg4860 when I had bumped up my internet speed. But great input - thanks.

UDP Broadcast Relay - what happened to Instance ID ??

dennypage — Thu, 19 Feb 2026 18:11:09 GMT

@DBMandrake said in UDP Broadcast Relay - what happened to Instance ID ??: And either of these options are better than the built in udpbroadcastrelay how exactly ? Using a local service with ptp activation generally represents a much simpler and more reliable solution. To me, relaying an unreliable packet through multiple hops/agents is rather fragile. And with UDP broadcast forwarding, the prospect of unexpected loops is always a concern. YMMV. That said, if you are comfortable with the solution you have, then by all means use it.

DNSCrypt Proxy Package Available - Full GUI Support

youngy — Tue, 17 Feb 2026 22:09:19 GMT

@nopoz Many thanks for this. I installed your package a few days ago - following the standard instructions and your comments above. Everything works well including when the gateways failover. Thank you for bringing this package to pfSense and for your help on here. Best wishes,

FreeRadius Log Problem

krasykp — Tue, 17 Feb 2026 09:25:56 GMT

@Gertjan said in FreeRadius Log Problem: Just the "Fix missing system logs from daemon facility (Redmine #16682) Yes, only "Fix missing system logs from daemon facility (Redmine #16682) BR, Krasimir

Challenges with pfSense and Zabbix release schedule alignment

andrew_cb — Tue, 03 Feb 2026 17:39:05 GMT

Zabbix has Standard and LTS lifecycles.
LTS releases are released every 18 months and are supported for 5 years. They are denoted by version ending in X.0 (i.e 6.0, 7.0).

Standard releases are released every 6 months and are supported for 12 months. They are denoted by version numbers ending in X.2 and X.4 (i.e. 7.2, 7.4).

https://www.zabbix.com/life_cycle_and_release_policy#maintenance

Most recently, it took 11 months from the request of Zabbix 7.4 packages until they were approved, and they still won't be available for another 2+ months. The Zabbix 7.2 packages never even had a chance since they went from released to EOL in that timespan. See
[https://redmine.pfsense.org/issues/16089 for full details.](https://redmine.pfsense.org/issues/16089 for full details.)

The timeline looks like this:
November 2024: pfSense Plus 24.11 released.
December 2024: Zabbix 7.2 is released.
March 2025: Request for Zabbix 7.2 packages. PR submitted.
May 2025 (early): Netgate staff confirmed the Zabbix 7.2 packages are not available in pfSense 24.11.
May 2025 (late): Netgate staff confirmed the Zabbix packages are not available in pfSense 25.03.
July 2025: Zabbix 7.4 is released.
August 2025 (early): Netgate staff confirmed the Zabbix 7.2 and 7.4 packages are not available in pfSense 25.07.
August 2025 (late): Netgate staff confirmed the Zabbix 7.2 and 7.4 packages are not available in pfSense 25.07.1.
December 2025: Netgate staff confirmed the Zabbix 7.2 and 7.4 packages are not available in pfSense 25.11.
January 2025: Netgate staff approve Zabbix 7.4 packages for the upcoming pfSense version (currently expected to be 26.03 in March 2026).

A similar situation exists for Zabbix 7.0 packages:
June 2024 - request for Zabbix 7.0 packages.
December 2024 - Zabbix 7.0 packages are released for pfSense 24.11

This creates several issues:

Updated Zabbix packages for pfSense are only released with new pfSense versions.
Packages for new Zabbix versions are not available for older/current versions of pfSense.
Unpredictable release schedule for when a new pfSense version will include updated Zabbix packages.

Zabbix requires proxies to be the same version as the server in order to add a new proxy or for an existing proxy to receive configuration updates. The proxy is needed for storing data during periods that the server is unreachable (such as when pfSense's internet connection goes down), for using pfSense to monitor other devices on the network, and for certain types of Zabbix 'Active Checks'.

This results in a significant problem: When a Zabbix releases a new version, you cannot upgrade to it until after you have upgraded ALL of your pfSense devices to the latest pfSense version. Based on the pfSense and its indeterminite Zabbix package release cycle, this can be anywhere from 6-12 months. Taking some time to testing a new pfSense version before deploying it to all devices adds even more of a delay.

On all other platforms, a Zabbix agent/proxy can easily be updated without downtime or interruption. However, on pfSense, this becomes a major effort that requires device updates, downtime, and is subject to the whims of when the packages are released. For something as simple as a monitoring agent, this is unworkable.

I am hoping a solution can be found that will allow quicker releases of updated Zabbix packages that are not dependent on using the latest version of pfSense. I am even willing to volunteer to be the Zabbix maintainer for pfSense if that will help.

telegraf failure due to deprecated ssl_ca parameter

kiokoman — Thu, 29 Jan 2026 16:26:04 GMT

@cadince i have the same problem plus i noticed that alot of parameters are not accepted anymore like #dns_lookup = true for [[inputs.ntpq]] #path = ["/usr/local/share/snmp/mibs"] for [[inputs.snmp]] #path = "/usr/local/sbin/smartctl" for [[inputs.smart]] configuration specified the fields ["path"], but they were not used; this is either a typo or this config option does not exist in this version

Client FTP Proxy Daemon Crashing

adeparker — Tue, 27 Jan 2026 10:50:57 GMT

Good morning,

We are experiencing an issue with the Client FTP Proxy Daemon package stopping/crashing every couple of weeks. A bit of an overview of the scenario:

Brand new Netgate 4200 running pfSense+ 25.11-RELEASE. Customer has a package running on their internal server which connects to multiple suppliers throughout the day to upload purchases and receive notifications back that it's been acknowledged. This is purely an outbound connection from the LAN to WAN, no inbound connection needed. The majority of these systems use APIs on start HTTPS so work fine. One specific supplier though still uses FTP for upload of an XML file. As much as it would be great to get that supplier to switch interface, given they are part of a £6 billion business very much doubt they are going to change.

Connecting to FTP via Filezilla on the internal server works fine. Filezilla will connect and upload a file without issue. Running via Command Prompt the connection disconnects as soon as try to PUT a file. My belief is it's do to with passive/active FTP, with Filezilla being able to switch but Command Prompt and the customer software also not able to.

This was resolved by installing the Client FTP Proxy Daemon package but has an issue where the Daemon will stop/crash every couple of weeks. The Daemon can be restarted instantly and things return to normal.

Can anyone offer any advice on what steps to take next?

Thanks in advance

Adrian

Pacakge manager has no package available

johnpoz — Sat, 10 Jan 2026 16:26:59 GMT

@pylessard great to hear, now don't wait 8 years to update again ;) 26.03 will be the next update. Here in the next few months.. Knock on wood actually in March ;) heheh That is if 3100 is still supported.. At some point it will drop off support - since it is arm based and all. Curious how your wan gateway was wrong in your current backup?

NRPE - check_pf_ipsec_tunnel problem when using name

Fazy — Tue, 23 Dec 2025 14:52:41 GMT

Hi!

I've just faced an issue with the following.
I have an ipsec tunnel, where only one of the endpoint have fixed IP, so the other one (machine name pioneer) will not initiate the connection. Since I would like to check this tunnel status aswell, I've tried to setup with a domain name, which actually resolves to the right IP address.

The generated nrpe.cfg line on pioneer:

command[check_ipsec_status_tunnel1]=/usr/local/bin/sudo /usr/local/libexec/nagios/check_pf_ipsec_tunnel   -e xyz.duckdns.org

If I run the command on pioneer, it works fine:

[2.7.2-RELEASE][root@Pioneer.abc.local]/root: /usr/local/bin/sudo /usr/local/libexec/nagios/check_pf_ipsec_tunnel   -e xyz.duckdns.org
OK - IPSEC VPN tunnel to xyz.duckdns.org - ESTABLISHED 30 minutes ago

If I run the check with nrpe from the icinga server however:

[user1(Hubble:0)] <~> /usr/lib/nagios/plugins/check_nrpe -2 -t 180 -H pioneer.abc.hu -c check_ipsec_status_tunnel1
CRITICAL - IPSEC VPN tunnel not found: xyz.duckdns.org

I've checked the ipsec script, and my idea/feeling (I was not able to prove so far) is that the dig command inside the script will not run properly.
I've tried to echo out the result of the dig command:

        hostip=$(dig +short $endpoint)
echo $hostip

This works well from the local machine (i got the right IP), but when I run it from the remote host, I got an empty line...

Any ideas? If possible, can it be fixed somehow?

Thanks
Peter

ANDwatch 2.1 in pfSense 25.11-RELEASE and RAM disk

MBehr2 — Sun, 21 Dec 2025 15:55:45 GMT

@dennypage Thanks - worked like a charm, applied and tested with a reboot. All good now. Was over thinking this and would have pasted the entire 40+ lines of code - even tho only one line changed. Yet another reason not to do what your not sure of LOL Only difference is my Patch ID has a different hex value. I'm gathering it's because I have other patches installed and the system creates this upon install. Again, thanks

Problem enabling mDNS Bridge after removing Avahi

dennypage — Sun, 21 Dec 2025 03:31:25 GMT

@terryzb said in Problem enabling mDNS Bridge after removing Avahi: @dennypage Ran into a slight problem that I was able to solve but thought I'd report here in case others run into it. While upgrading a 2100 from 25.0.7 to 25.11, I followed best practices and first removed packages (pfBlockerNG, Avahi and a couple more). After the upgrade I installed mDNS Bridge to test the replacement for Avahi. After trying to enable it I got: "Avahi reflection must be disabled before enabling mDNS Bridge" I rebooted the 2100 but same problem. I then reinstalled the Avahi package and disabled it. Then mDNS Bridge could be enabled. I finished by removing the Avahi package again. A couple simple tests and mDNS Bridge seems to be working well mirroring an iPhone to an AppleTV. Thank you very much @dennypage for this package. Thank you for the report. Much appreciated.

Filer pkg bugs

dennypage — Thu, 18 Dec 2025 19:26:58 GMT

@luckman212 said in Filer pkg bugs: @dennypage Hmm - interesting overload usage there! Definitely never would have thought of that. Does it work for creating new files too? Yes, it works for creating files. In fact, that’s why you have to mark them as non auto apply—if you don’t, it keeps prepending another copy of the text each time an apply happens. Edit: Back in front of a computer... Here are the patches I mentioned from my system: --- /conf/ntp-boot-time-servers 1969-12-31 16:00:00.000000000 -0800 +++ /conf/ntp-boot-time-servers 2022-02-15 15:29:29.980757000 -0800 @@ -0,0 +1 @@ +192.168.230.32 192.168.230.33 192.168.230.34 --- /boot/loader.conf.local.org 2024-04-23 08:00:00.000000000 -0700 +++ /boot/loader.conf.local 2024-04-23 08:00:00.000000000 -0700 @@ -0,0 +1,2 @@ +hint.mmcsd.0.disabled="1" +legal.intel_ipw.license_ack=1

Can't get packages to update

hypnosis4u2nv — Thu, 18 Dec 2025 01:30:33 GMT

So the problem definitely lies in Hardware TCP Segmentation Offloading as I was able to disable Hardware Large Receive Offloading without the issue occurring.

Unable to start FreeRADIUS service

Gertjan — Wed, 03 Dec 2025 10:30:00 GMT

@scottastic86 You've showed why and where there error occurred .... We, here on the forum, can acces that file, but the pfSense admin = you, you can ?! Have a look at this file : /usr/local/etc/raddb/mods-config/files/authorize When you see the file, you'll think : where did I see this before ? It's the info you entered here : [image: 1764763153476-4474cf8a-c7dd-49a9-8891-f7fbc85c9470-image.png] Start by checking all the entries : remove accented chars, all ' " `` etc. Just plain ASCI text. To test radiusd in debug mode : On the command line : radiusd -X and you'll see where it fails. But you already know where. Ctrl-C to abort. @scottastic86 said in Unable to start FreeRADIUS service: I deleted and rebuilt the Captive Portal The portal isn't radius related. Your issue is 'radius', not the portal. @scottastic86 said in Unable to start FreeRADIUS service: uninstalled and reinstalled the FreeRADIUS package But you kept your freeradius settings with an error in place ^^

udpbroadcastrelay vs mcast-bridge vs mdns-bridge

luckman212 — Thu, 13 Nov 2025 15:32:10 GMT

thanks Denny- as usual I learn something from each and every one of your posts. On this system, I didn't have NUT, andwatch, vnstat etc installed so for me mdns-bridge.sh was the only file with the .sh suffix.