pfSense® Plus software version 24.03-RELEASE is here! 🥳
-
@jimp Would this also resolve the issues with trying to fetch pfBlocker and Suricata updates to lists after upgrade before interfaces come up?
-
hey there,
just run thru update process...did a reboot prior to pressing that "update" button as recommended. Kept all packets though...It took around 8 minutes (6100 appliance), rebooted...what to say? All seems to be working fine, terrapin patch included in 24.03, ULA patch not necessary any more (reverted the old patch still showing, deleted it then...still working for ULAs in VIP, all shown on tables).
All services came online by themselves. Settings (iE for freeradius) still there and VPN with 2fa still working...So far: great work, people! Thanx... :)
-
@the-other ok, another facepalm to myself...
It is clearly stated under System / Patches NOT to revert a patch after upgrade...happy are those who can read (and understand what they are reading...).
So of course all ULAs were gone from tables...re-aplied that patch and all is well again.
Sorry for any confusion...the other
pure amateur home user, no business or professional background
please excuse poor english skills and typpoz :) -
24.03_1 is out now?
-
@Cylosoft yeah, scroll to the very first post in this thread...it's explained there (update)... :)
-
@Cylosoft Where did you get about 24.03_1 as only 24.03 out?
-
@Antibiotic said in pfSense
Plus software version 24.03-RELEASE is here! 🥳:Where did you get about 24.03_1 as only 24.03 out?
See the announcement at the top of this thread.
-
Seems to have worked OK in the main biw, but a bit of oddness with my upgrade process.
It seemed to be taking too long and I was a bit nervous (I was still waiting for pings 8 mins in) - so I hooked up a monitor to my appliance to have a quick look. As per the upgrade process it was refreshing the packages and it was reinstalling Snort, I'm not sure if this is an issue with the Snort package or pfSense....but....it was trying to download all the block lists/community rule sets for Snort etc BEFORE any interface had initiated, so the reason it took ages to come up is because every rule set was trying and timing out on the download, as expected...because it was trying to do it before it brought the interfaces up!
I did another couple of reboots after that and the same symptom didn't re-occur, so I imagine this was just an upgrade oddity and it sorted it's self out (just needed to be patient).
There is also a fundamental issue with pfBlocker, but this is resolved with a custom patch someone has made (see this thread - https://forum.netgate.com/topic/185207/24-03-development-php-fatal-error-uncaught-valueerror-range-argument-3) - Hopefully that's updated at some point to remove that issue from the main release.
The first thing I wanted to try, something I've been keen to test is the WAN Gateway failover...failback, and it works a charm. I don't know if anyone else uses Wireguard tunnels, but on a gateway failback these never, ever came back to the primary connection without pulling the plug on the backup connection - but now they do recover and swing back to the primary on gateway restore without any intervention. It does take a bit of time, 2-3 mins, so I'm going to look and see if there's anything I can do to improve it slightly - but it's still an improvement and removes the manual intervention.
-
@crucialguy Do you use traffic shaping?
-
@Antibiotic Nope, no traffic shaping whatsoever here.
Standard traffic flows and gateway groups with PBR etc.
-
@crucialguy For me slowly upgraded 7100 DT router (15 minutes) has Suricata. 6100 which upgraded reasonably fast does not have Suricata.
It could be the reason you pointed.
I am happy to run latest pfSense+ software. -
Woooohooooo!
Up and running 24.03-RELEASE.
SG-5100 on ZFS (128 GB M.2 SSD & 16 GB RAM). Took about 10 mins and not glitches.I run pfBlockerNG, but no issues that I see yet.
Phizix
-
@crucialguy Believe your issue of pre interface downloads was discussed somewhere here a week or two ago.
Thanks for the pfB pointer.
-
S SteveITS referenced this topic on
-
@the-other said in pfSense
Plus software version 24.03-RELEASE is here! 🥳:So of course all ULAs were gone from tables...re-aplied that patch and all is well again.
Sorry for any confusion...Now I am confused, so you are saying, you still need that patch?
-
Looks like 24.03 upgraded bootloaders on both disks on ZFS mirror, redmine #15084 is still open though.
Maybe it was fixed in FreeBSD 15.0...?pfSense Plus 24.03-RELEASE (amd64)
Dell Optiplex 7040 SFF
Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
HPE 561T (X540-AT2), 2-port 10Gb RJ45
HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+ -
Ran the update on a Protectli FW4C this morning before anyone needed the internet. Started at 6:15 and by 6:45 everything was updated and no issues. I was able to log in at about 6:35 and some services were still offline with red checks while being updated.
-
@mvikman said in pfSense
Plus software version 24.03-RELEASE is here! 🥳:Looks like 24.03 upgraded bootloaders on both disks on ZFS mirror, redmine #15084 is still open though.
Maybe it was fixed in FreeBSD 15.0...?There was some work done to help there but there may still be an edge case or two around that needs work yet (or at least testing/confirmation). Since that's a rather critical part we kept it open until we know for sure that all of the problem scenarios are working properly now.
-
J jimp referenced this topic on
-
@Bob-Dig well, as mentioned under System > Patches:
"After upgrading, do not revert a patch if the changes from the patch were included in the upgrade. This will remove the changes, which is unlikely to be helpful."So, yeah...
I made the mistake to revert and delete said patch. So tables did not get my ULAs anymore.
Re-applied the patch, and ULAs are back in tables and also all rules are working again (with ULA) without EXTRA ULA rules...(workaraound before that patch was published, remember?)
:) -
@the-other said in pfSense
Plus software version 24.03-RELEASE is here! 🥳:Re-applied the patch, and ULAs are back in tables and also all rules are working again (with ULA) without EXTRA ULA rules...(workaraound before that patch was published, remember?)
:)Not really, all the IPv6 discussions go that route anyways. But as I read the changelog, you don't need a patch for this anymore. I would tripple check this. I don't use ULAs anymore, so I can't test this.
-
Hi,
Got this message today.
I updated and still stays:
