23.05.1

michmoor

@mcury said in 23.05.1:

Packages used: pfBlockerNG, Wireguard, Softflowd, NUT, Acme and the others installed by default.

Curious. What are you using as a NetFlow collector?

Cabledude

@mcury said in 23.05.1:
Thanks for your report

As usual, uninstalled pfblockerNG, Softflowd and NUT before upgrading.

New to uninstalling before upgrade. So let's say I were to follow your lead. Would I:

create config backup
uninstall packages like pfBlocker (is there a list of which packages should be uninstalled?)
perform upgrade
load config backup, so that the necessary packages are downloaded and installed automatically + their config is restored

?

Thanks!

jimp

The "remove all packages" part is more important for CE users making the gigantic leap from 2.6.0 to 2.7.0 and all the PHP and base OS changes that go with it. All our internal tests have been OK but we've had a few users report that some of their packages failed to update on the way to 2.7.0 and caused other issues.

If you're going from 23.05 to 23.05.1 the risk is much, much lower.

23.01 to 23.05.1 is probably still worth taking out packages for (PHP moved to 8.2) but still less risk than going from the old PHP 7.x code in 22.x up to 23.xx.

And in terms of what to uninstall, uninstall them all unless a package is 100% necessary for your upstream connectivity somehow, and then leave only what is absolutely needed.

mcury

@michmoor said in 23.05.1:

Curious. What are you using as a NetFlow collector?

Graylog:

michmoor

@mcury I dont want to pollute this thread with my graylog question but I am also pushing netflow to graylog but having trouble creating usable charts.
You mind sharing the dashboard config? I assume you're doing an aggregation table and all that.
Appreciate you @mcury

mcury

@michmoor Sure, open a new thread and I'll share everything I have set it here..

It's a simple setup, no aggregation.. It's working as a Syslog server for Synology, Unifi and pfSense.
But I'm also exporting netflow from pfSense to Graylog.

keyser

Upgraded a 2100 and 6100 from 23.05 to 23.05.1 without issues (very quick update, no package reinstall).

Packages running: pfBlockerNG, Syslog-ng, tftp, lldpd, notes, NtopNG, Freeradius, Nut

johnpoz

So I just pulled the trigger.. Took a current config backup, consoled in so could watch the upgrade - all smooth.

Took total of about 6 minutes on my 4860... Logging in now, seems all good.

chudak

Upgraded to 23.05.1 with no issues

Did not uninstall any packages, including pfBlockerNG

Cabledude

@jimp thanks for clarifying. You say with pfSense Plus 23.05 to 23.05.1 the risk is much lower. So there still is a risk and some users here do uninstall.

I could make uninstalling packages a principle or standard workflow. Could you comment on the steps I listed above:

create config backup

uninstall packages like pfBlocker (is there a list of which packages should be uninstalled?)

perform upgrade

load config backup, so that the necessary packages are downloaded and installed automatically + their config is restored

Would you say this is it? Any alterations advised?

Thanks!

jimp

I wouldn't bother with the config restore, just install the packages again. The config restore is a fairly harsh way of saving a handful of clicks.

It will work, but it's like swatting a fly with a cannon.

johnpoz

@jimp said in 23.05.1:

It will work, but it's like swatting a fly with a cannon.

But what if its robotic fly with steel plating? ;)

Cylosoft

For our 2.6 to 2.7 boxes I uninstalled PfBlocker and left all other packages. 23.05.1 I left all packages installed. I'm about 20 boxes in now and zero issues.

FSC830

To be honest: I did never uninstall a package prior updating.
Since 2.4.5 I am running the updates in current status.
I did only see one issue, but I cant remember if really a package was the culprit or something else.
And I remember that one update fails and I need to recover from recovery image.
Thats my fallback, I always request the recovery image from TAC prior updating.

Will update to 23.05.1 during weekend .
Appliance is a SG-3100

Regards

Edit: Update done, no issues.

Cabledude

@jimp said in 23.05.1:

I wouldn't bother with the config restore, just install the packages again. The config restore is a fairly harsh way of saving a handful of clicks.

It will work, but it's like swatting a fly with a cannon.

Ah okay, thank you. I assumed that package configuration (settings sections) would be reset to their defaults if packages are simply uninstalled and reinstalled, but if I understand you correctly the settings will be retained?
So let's say I uninstall Avahi, perform update and reinstall Avahi, will the system have remembered the Avahi settings such as which interfaces, repeat packet across subnets etc.?

Thank you

dennypage

@Cabledude said in 23.05.1:

So let's say I uninstall Avahi, perform update and reinstall Avahi, will the system have remembered the Avahi settings such as which interfaces, repeat packet across subnets etc.?

Yes, Avahi's package settings will be retained.

jimp

@Cabledude said in 23.05.1:

@jimp said in 23.05.1:

I wouldn't bother with the config restore, just install the packages again. The config restore is a fairly harsh way of saving a handful of clicks.

It will work, but it's like swatting a fly with a cannon.

Ah okay, thank you. I assumed that package configuration (settings sections) would be reset to their defaults if packages are simply uninstalled and reinstalled, but if I understand you correctly the settings will be retained?
So let's say I uninstall Avahi, perform update and reinstall Avahi, will the system have remembered the Avahi settings such as which interfaces, repeat packet across subnets etc.?

Upgrading a package effectively uninstalls the old package and reinstalls the new version. Same as if you did it in two steps before/after a reboot.

By default package configurations are retained in the firewall config file and only the metadata about the package is altered (e.g. the info about the package files, menus, tabs, plugins).

There are a small number of packages which have an option to wipe their config on reinstall but that isn't their default behavior, you have to explicitly set them to clear the config.