Now Available: pfSense® Plus 25.07-RELEASE

F00d

Upgraded 3100 from 24.11 to 25.07. Everything seems normal. The upgrade took about 10 minutes until the web UI reloaded. Installed packages include: Cron, RRD_Summary, Service_Watchdog, WireGuard. I'm following the advice to remain on ISC and not migrate to KEA due to arm32 incompatibility with the 3100.

ITSGS_

Updated from 25.07.r.20250715.1733.1500029 to 25.07 on my SG4200. No issues so far.

Cylosoft

It looks like Kea still has issues with static entries at times pulling an IP out of the pool.

Gertjan

@provels said in Now Available: pfSense Plus 25.07-RELEASE:

Just me, or can't we edit posts anymore?

Not on Netgate's 'Pinned' forum posts.

Dean79

I successfully upgraded my SG-1100.

Before upgrading, I backed up the config, deleted all packages, and updated firmware via the GUI rather than the console.
After upgrading my SG-1100 to firmware version 25.07, most of the resource overload issues that occurred with the previous version 24.11, were resolved, making it much more efficient. I had previously only been using the PFBlockerNG and Snort packages.

When I used version 24.11 on my SG-1100, the load was extremely high, reaching 100% CPU and RAM usage, frequently resulting in performance degradation and crashes down.
However, the current version 25.07 has reduced the load to about 30-70%.

This appears to be a very successful upgrade. I'd like to thank the Netgate developers for their hard work.

sjhawke

Upgraded SG-2100 BASE - updated with a 128Gb SSD (Internal drive wear was too high).

Upgrade process was ok, though it did get confused and give the "another process" error in the updates screen.

After update:

Unbound crashed with out of memory error. Switched to python mode and it seems to work, though pfblocker dns filter service then failed to start on boot and needed starting on the portal.

Hope these things get patched soon.

Simon

Gertjan

@sjhawke said in Now Available: pfSense Plus 25.07-RELEASE:

Switched to python mode

Still using 'Unbound mode' is popping often rather often these days.
A bit strange, as to really make shine pfBlockerng, you had to switch to the back then new Python mode :

should / would enough to convince people to switch over

sjhawke

@Gertjan - good point - I didn't see that. Wish I had. Generally don't mess with stuff that is working, until it isn't.

Phizix

@Gertjan,

Curious what hardware you were updating?

tman222

After cruising along at 180 days+ of uptime on 24.11, I decided to move ahead and upgrade to 25.07 this evening. Upgrade went flawless and probably took around 5 minutes on a Xeon D-1718T based system. Happy to see Unbound 1.23 included (there were some bug fixes in that release related to serve expired that I was looking forward to) as well as reduced CPU usage when viewing the dashboard page.

Thanks to everyone at Netgate for all your hard work on this release!

kymmitsu

Anyone knows why this has come up - SG-2100 - took 20 mins to get past - I thought it was locked up - one Acme *.domain cert only ? This was upgrade and fresh.

[48/72] Extracting ca_root_nss-3.104_1: ....... done
certctl: Skipping untrusted certificate 57bcb2da (/etc/ssl/untrusted/57bcb2da.0)
certctl: Skipping untrusted certificate 08063a00 (/etc/ssl/untrusted/08063a00.0)
certctl: Skipping untrusted certificate 5e98733a (/etc/ssl/untrusted/5e98733a.0)
certctl: Skipping untrusted certificate 18856ac4 (/etc/ssl/untrusted/18856ac4.0)
certctl: Skipping untrusted certificate 5e98733a (/etc/ssl/untrusted/5e98733a.0)
certctl: Skipping untrusted certificate 18856ac4 (/etc/ssl/untrusted/18856ac4.0)
certctl: Skipping untrusted certificate 08063a00 (/etc/ssl/untrusted/08063a00.0)
certctl: Skipping untrusted certificate 57bcb2da (/etc/ssl/untrusted/57bcb2da.0)
[49/72] Upgrading php83-sqlite3 from 8.3.12 to 8.3.19...
[49/72] Extracting php83-sqlite3-8.3.19: ......... done

SteveITS

@kymmitsu The short answer is, that’s “normal” and it takes a while to chunk through that step on the 1100/2100’s CPU. Or similar; the 2220 I updated through a few versions to 24.11 recently took around 25-30m for each update + reboot.

pfBlocker also took what seemed like 10 minutes to install on a 2100 last night.

The “skip” lines are normal also.

johnpoz

Yeah my vm took took quite some time to get through the certs when it updated the nss package - I was starting to get a bit worried myself that something was going on.. But its a very low powered vm, only 1 cpu and only 512MB of ram.. And running on a NAS, so its not a rocketship by any means.

My sg4860 did better, but it still took a few minutes to get through that.

Wonder if might be a good idea to add to release notes, but then again doesn't seem like everyone reads those before clicking update anyway ;)

GeorgeCZ58

Upgraded multiple XG7100, 6100 and one SG1100 without any issue.

patient0

Upgraded a 1100 from 25.03-BETA to 25.07-RELEASE from within the GUI, no issues.

HorstZimmermann

Updated without any problems (non Netgate Hardware)

Thank you for this update

crucialguy

Just for some feedback in case anyone else encounters this, I had an unexpected issue during my upgrade from 24.11 to 25.07.

Everything went OK, and then the Firewall went down for reboot. 10 mins later, still no Firewall. 20 mins later it came back, but on 24.11.

So I tried again and stuck a console output on my hardware. The OS loads 25.07, but gets stuck at updating configuration.........for what feels like forever. After 900 seconds, xmlparse.int throws an error and it reboots back into 24.11.

This odd issue was caused by bloated backups in the /var directory. I had mine set to purge every 30 days, but it doesn't seem to have been doing it - so unbeknown to me, I had 10G worth of backups and it was chocking the xmlparse.init file on upgrade.

I cleared out most of the backups (it went back a year), tried the update again and it went through smoothly.

Just thought I'd share if anyone else found any problems.

SteveITS

@crucialguy That’s a bug in 24.* but if you go to the config history page it will prune them out, but the page will probably time out before it does.

markster

After upgrade I noticed few things that stopped working for me.

Avahi logs show that all has started fine but apple mirroring or airplay does not work anymore. System logs shows that Ahavi started on selected subnets but I do not think that it makes necessary changes to IP tables and enable cross subnet communication.
Enabling KEA DHCP works but some LG TV clients would not "auto connect". (my Unbound DNS is on different host). To get it to connect I have to disable "auto connect" and configure TV to use static IP.

dennypage

@markster said in Now Available: pfSense Plus 25.07-RELEASE:

System logs shows that Ahavi started on selected subnets but I do not think that it makes necessary changes to IP tables and enable cross subnet communication.

Avahi does not make firewall rule changes, and no changes are necessary for Avahi to function with the default set of firewall rules. This has been the case for many, many years.

It's possible to break Avahi functionality If you specifically add rules to block inbound mDNS traffic to firewall interfaces, but that would be a conscious act.