pfSense 2.8.0 full iso/img
-
@pppfsense Good Luck with that. What shines isn't always gold.
-
@pppfsense said in pfSense 2.8.0 full iso/img:
Yep. Time to move to opnsense.
For sure not, I'm very happy with pfSense since over 14 years now.
@netblues said in pfSense 2.8.0 full iso/img:
Time to change ISP.
Well, ISP with fiber connection in my area one of one.
-
@KOM
It was pfsense the one that taught me to be cautious and ready to reinstall from scratch after most of the previous versions borked the upgrade and thus the system:-Don't update automatically or right away.
-Check change logs of the updates.
-TEST the updates on a non-essential system with similar configuration.But the best part is that opnsense did implement zfs boot environments!
(I implemented this myself in pfsense, but only command line.
Netgate can easily add this feature to CE, but they will not, on purpose).So, simply use their zfs boot environments gui and revert to any previous boot snapshot!
But it will all be clear in the coming years with the CE release cycle and the decisions/direction that Netgate takes, right?
-
@stephenw10 said in pfSense 2.8.0 full iso/img:
I mean there is an ISO image for the Net Installer. I assume you mean an offline install image?
It adds a bunch of testing for us to have multiple installers.
You can still just use the 2.7.2 legacy image and upgrade though.
That's not a great solution for us. We have a bunch of legacy APU2 devices that are going to need to be upgraded and the second 2.8.0 upgrade I tried obliterated the FW I was upgrading.
With 2.7.2 and earlier, our recovery plan would be someone going on-site, installing 2.7.2, and restoring a backup. That worked great because we have our own backup system where we can drop the config on a USB and have a system restored in ~5m.
Now, we're going to have to endure an upgrade that, after uninstalling and re-installing packages as recommended, is going to take 15-30m and may or may not work. Or the other option is to waste time with the online installer where we need to have the WAN settings documented and entered by hand.
So recovery from a failed update has gone from a simple process to a convoluted mess and changed from being something that we can deal with quickly to something that's an embarrassment for us while we sit on site with downtime that's far worse than it used to be.
All of our new installs are official Netgate devices now, but I still have ~125 APU2s to deal with. The online installer is a pain for all devices.
For our use, the online installer is an objectively worse experience. I personally hate it. I'm already getting pressured to switch to Ubiquiti FWs and now I'm going to have to explain how our current solution just got worse. How do I keep pitching pfSense? I'm so frustrated by this.
-
I'm sure there are reasons behind such moves, but I can't think of any that are beneficial for the pfSense CE community.
For example, I can't download now because apparently Netgate store is banned (incorrectly mind you, had no idea that this was the case) in my region, even though I didn't mean to buy it, only to download an ISO of supposedly Open Source project, which apparently no longer exists.
So I can't really run a script to build it from source, I can't download a prebuilt ISO either. Does it improve my confidence in pfSense CE? Not really.
In fact I'd be happy to pay some amount for CE that use use for personal purposes, but not for Plus that can be pulled from under me at any time (I remember community was encouraged to upgrade for free not so long ago, but then apparently was left without clear downgrade path).
Please seriously reconsider your relationship with Open Source community, it could use some improvement.
UPD: I was just thinking about reinstalling my VM to switch from BIOS to UEFI. But since Internet comes from that VM, I can't really do that without offline installer (let alone I'm unable to download even online installer now). I could install 2.7.2 first, but then backup from 2.8.0 will likely cause problems. You cause so much frustration for me now
-
I can't edit my post anymore, but I spent a few hours trying to reproduce my upgrade failure and couldn't. Based on what I tested, I had a hardware failure during the update since a reload / restore of 2.7.2 didn't help (WAN was flapping up and down every second). So, to be clear, the issue I had didn't have anything to do with the update to 2.8.0.
-
@nazar-pc said in pfSense 2.8.0 full iso/img:
I'm sure there are reasons behind such moves, but I can't think of any that are beneficial for the pfSense CE community.
…
I can't really do that without offline installer … so much frustration for me nowYou are dreaming if you think Netgate are going to provide an offline installer for their free but not paid version. I agree an online installer is more convenient however it makes no business sense for Netgate to make using their free version a better experience than their paid version.
If there is any chance of improving the CE experience it will have to be at least as good with the plus version.
I suspect it comes down to Netgate having an enforceable mechanism of pfsense run time use. Imo probably best done by requiring regular run time license validation, with failure resulting in staged reversion to CE, with generous warning. Doing so would enable transfer of plus license to different hardware and offline plus installation.
-
Upgrade is not the same as clean install
uname -r 15.0-CURRENTawk '/__FreeBSD_version/ {print $3}' /usr/include/sys/param.h numbers is '/^\#define[[:space:]]*__FreeBSD_version/ 1400094Clean upgrade from 2.7.2
I am porting zerotier to pfSense and this marketing with online installer stinks bad.
-
Hmm, not sure what you're showing here?
The upgrade from 2.7.2 uses the same pkg repos the Net Installer does.
-
The move to a unified installer I can understand a bit, but the lack of offline install support is a bad move by Netgate. With this single decision Netgate has chosen to almost completely eliminate themselves as a option for every non-internet connected, high security, or classified system around the globe. I highly suggest Netgate reconsider releasing offline install packages.
-
Just noticed this after posting here
@dark-baritone said in Internet Connection Required On New Installations:
Re: Mandatory internet connection on new pfSense installer
@stephenw10 advantages for whom?
It's completely nonsensical for router firmware to require an internet connection. What if I want to setup VPNs before I make any outbound network connections? What if my internet hasn't been installed yet and I want to setup my internal network while I'm waiting? What if my ISP requires some advanced configuration in order for me to connect? What if I need to assign a specific MAC address in order to connect?
There are myriad different reasons why we wouldn't want to install with internet access.
If you want to give someone the OPTION of checking for the latest update before installing, that's absolutely fine.
Literally every Linux distribution works like this. There is no reason that pfSense can't do it.
The old (correct) images are available here but the new 2.8 version is not there. When are those going to be added to the list?
-
Additional feedback on Reddit
-
@stephenw10 it was noted on that Reddit thread by gonzopancho (who seems to be the CEO?) that there is an offline pfSense Plus installer? Is this only available for Netgate hardware or can users install via a fresh install completely offline?
-
Netgate installer 1.0-RC1 fails to install properly on HPE ML30g9. pfSense 2.7.0 installer works as expected.
Also, Netgate installer doesn't have the normal way of configuring ZFS before install (setting swap size for example), but pfSense 2.7.0 installer does.Would prefer an option to include (or add) all the needed files in USB image, so that it can work without internet connection.
and for the ZFS options to be added back into installer.
-
Well, looks like it is the new kernel (or the configuration for it). After upgrading it won't boot with default kernel, but will boot with old kernel and works that way. Rolling back to 2.7.2 and will wait for a 2.8.x version with a kernel that works on an HPE ML30g9
-
The new installer has a bunch of additional options including SWAP size. Should be available pretty soon.
-
BACKGROUND
With 2.7.2 CE, I have a USB flash drive with my most recent config.xml file for an emergency offline restore in case my appliance fails. It automatically install pfSense and my config.xml file during installation.
The reason is if my appliance fails (for what ever reason), since pfSense hosts all my services (DNS, DHCP, routing, etc.) I will loose access to devices on my network and internet until I have a working pfSense appliance. The only time I have needed to use it is when upgrading my pfSense appliance.
2.7.2 CE README.txt
Note: I simply dropped the config.xml in the root folder and confirmed it works.
Restoring an Existing Firewall Configuration (amd64) ---------------------------------------------------- An existing configuration file (config.xml) can be restored during the installation process. Place a copy of the config.xml file on this FAT partition, in this directory or under X:\conf\config.xml where X: is the letter of this drive. At the end of the installation process, this file will be copied to the target drive and used in place of the default configuration. Packages will be restored after the firewall boots with the new configuration in place.MOVING FORWARD
Now that Netgate only offers an online installer, I loose the ability to perform an emergency offline install.
OPTIONS
- Create a bootable USB flash drive with an disk image of my install to allow offline emergency restore. - TBD
- Use the online installer with my config.xml and figure out how to get the appliance on the internet (Laptop on hotspot, appliance bridged to my laptop via wired Ethernet, etc.) - PITA
- Simply resort to installing pfSense on a cold spare appliance and test swapping it out. - Advantage is I can get all the packages and patches installed, plus update Tailscale and its keys.
- Figure out how to set up HA with a second appliance. - Additional power consumption and learning curve.
QUESTION
- Has anyone figure out a way to make a bootable USB flash drive with an disk image of an install to perform an emergency offline install?
If not, I guess #3 is my only other easy option.
-
@elvisimprsntr you can install pfSense and create a image with dd or clonezilla,...
-
You can also just install 2.7.2 and upgrade to 2.8 if your WAN doesn't allow using the current net installer. The upcoming net installer does allow a lot more options there.
-
@stephenw10 please stop offering that as a solution. That will only be a possible solution until there's an upgrade to pfSense that offers an installable solution that is not available in 2.7.2.
For example, if ZFS was not offered in 2.7.2, but was in 2.8.0, then the only way to get ZFS would be to use the inferior installer and hence would not be able to be installed offline.
And to be clear, I'm a Plus customer and also find the online installer unacceptable. I have no problem paying for software.
It would be entirely possible to have the Plus activation key, once registered on an online system, to generate a system-specific installer key that could be derived with the activation token so that an offline install could be done while verifying (without internet access) that it had previously been installed on that system. Once the system goes online, it can do a further verification to make sure nothing had been spoofed.
