Call for Testing: pfSense® Community Edition 2.9 Beta Now Available!
-
Netgate
is pleased to announce the release of a Beta of pfSense Community Edition version 2.9. Now it’s your turn to help us test this latest iteration of our popular open-source firewall and services platform software. This beta release brings a host of new features, enhancements, and fixes, and your feedback is crucial to ensuring a rock-solid final release.Feature Highlights
This Beta software includes a large number of security and feature enhancements. Some highlights include:
SSH Algorithms: This release includes several changes to algorithms for the SSH daemon for key exchange, encryption, and message authentication. These changes increase security by including post-quantum key exchange algorithms and by removing older and weaker algorithms.
TLS Certificate Strength: The version of OpenSSL in this release further tightens certificate requirements and removes support for certain weak properties. For example, if a TLS server certificate for a service such as the GUI has a weak key (<2048 bits), the service may fail with an error such as “key too small”. This version of pfSense software checks the GUI certificate during the upgrade process and will re-generate a new GUI certificate if the current certificate is invalid, expired, or weak.
TLS Certificate Auto-Renew: This version of pfSense software can automatically renew TLS server certificates which are self-signed or signed by an internal CA stored in the pfSense software configuration. Automatic renewal is a per-certificate option, and pfSense software automatically enables this option for the GUI certificate when possible. When automatically renewing a certificate, pfSense software uses the latest strict security options to ensure the certificate meets current standards.
Endpoint-independent Port Restricted Cone Outbound NAT: This version includes partial experimental support for “Port Restricted Cone” endpoint-independent outbound NAT. “Port Restricted Cone” NAT mappings attempt to preserve port and external address mappings for clients when speaking to multiple remote hosts, but in a dynamic way that does not rely on static port NAT. This helps avoid issues with multiple local clients using the same source port to the same remote host.
In addition to the features listed above, this Beta software includes critical security updates for WireGuard (CVE-2026-58085), and other security enhancements. This Beta software also contains over 150 other software enhancements.
Call for Testing
Testing of this Beta software is essential. Testing is the most effective way to ensure that the software is robust and reliable for all users, given the diversity of their environments and configurations. By downloading and testing this Beta software, and providing feedback on any issues, our users can play a vital role in improving the software for everyone.
Caution
As with any beta software, pfSense CE 2.9 Beta is not yet production-ready. Expect some rough edges - that’s where you come in! Please avoid deploying it in critical environments until the stable release is available.
The pfSense CE 2.9 Beta is a milestone in our ongoing mission to deliver a powerful, flexible, and free networking solution to users worldwide. Your participation in this testing phase directly influences the quality of the final product.
Release Notes:
https://docs.netgate.com/pfsense/en/latest/releases/2-9-0.html
-
P pfGeorge pinned this topic
-
@pfGeorge maybe a silly question: how do I get 2.9 Beta? I can't see it in the System / Update. Is it by installer only at this point?
-
@patient0 Although I was briefly offered the 2.9.0 Beta on my MAIN "Edge" Router, my First "TEST" was a Fresh Install using Netinstaller 1.2!
-
@LHoust thank you. Using the netinstaller v1.2 did work.
Including restore the config from the 2.8.1 installation as the first step of the installer. All is up and running with the previous configuration
(DHCP IPv4/IPv6 WAN from an upstream pfSense).On 2.8.1 ISC DHCP was used and that got taken over without an issue. I now have switched to KEA and that also worked well. Additionally I configured static IPv6 on (the only) LAN, all working.
Well done Netgate.
-
again a beta for a CE version, very nice and well done Netgate, thank you.
-
No 2.9 branch available for selection from 2.8.1.
-
@peppercorn said in Call for Testing: pfSense
Community Edition 2.9 Beta Now Available!:No 2.9 branch available for selection from 2.8.1.
Not here either ...
-
@FireOdo neither for me, I installed it using the installer. Installed over an existing installation, loading the previous config in the installer.
-
@patient0 said in Call for Testing: pfSense
Community Edition 2.9 Beta Now Available!:@FireOdo neither for me, I installed it using the installer. Installed over an existing installation, loading the previous config in the installer.
-
@patient0 After reading that netinstaller 1.2 can handle config restore upgrades successfully, my Second "Test" was upgrading one of my CE 2.8.1 VMs!
I will leave my Third "Test" for when upgrading through the GUI is "Working"...
-
I will leave my Third "Test" for when upgrading through the GUI is "Working"...
You mean when
2.9.0exits beta.
-
Unless CE numbering has officially changed, I believe you mean
2.9.0. -
said in Call for Testing: pfSense
Community Edition 2.9 Beta Now Available!:I will leave my Third "Test" for when upgrading through the GUI is "Working"...
This evening upgrading through the GUI was working for me, therefore I was able to Upgrade my Second CE 2.8.1 VM!
Therefore I has success with three different routes:
1- Fresh Installation using the Netinstaller 1.2, manually restoring my 2.8.1 config
2- In-Place Upgrade using the Netinstaller 1.2, where the Installer imported the 2.8.1 config prior to the upgrade
3- In-Place Upgrade using the GUI, which imported my 2.8.1 config as part of its Upgrade Process!Route #3 was a bit more on the "Messy" Side (there were some Error Messages), therefore I might suggest using Netinstaller 1.2...
-
@peppercorn said in Call for Testing: pfSense
Community Edition 2.9 Beta Now Available!:No 2.9 branch available for selection from 2.8.1.
-
Question: Is the ix driver updated to support newer Intel nics like E610-XT2? I couldn't find anything in the changelogs.
-
@pfGeorge
I see some package updates on 2.8.1, are these packages really for version 2.8.1, or only for version 2.9.0?apcupsd
freeradius3pfSense Gold subscription
-
@slu said in Call for Testing: pfSense
Community Edition 2.9 Beta Now Available!:apcupsd
Updated here 2.8.1 - no problem!
-
@slu said in Call for Testing: pfSense
Community Edition 2.9 Beta Now Available!:@pfGeorge
I see some package updates on 2.8.1, are these packages really for version 2.8.1, or only for version 2.9.0?apcupsd
freeradius3When your update path is set to 2.8.1 then the packages are for your version. Only when you set it up for 2.9 should updates to the beta be advertised
-
Upgrade to 2.9.0 from 2.8.1 on Protectli FW2B went fairly smooth using web GUI.
Had to perform a Force Reload to re-sync pfBlockerNG DNSBL.
Had to re-install CrowdSec (why is this not available in packages yet?).
Appears to have upgraded System Patches package as well (I thought this was going to be built-in but appears to be functional as a separate package as previous versions).
Smooth experience from my perpective.
-
Got a "WARNING: write_config() was called without description" on Save of CrowdSec settings (does not appear to affect functionality).
Privacy Policy · Cookie Policy