Holding off on upgrading to 26.07: Production stability, ThreatGate status, and CoreDNS observations
-
Hi everyone,
I wanted to share my perspective and rationale for holding off on upgrading our production environment from 26.03.1 (with system patches applied and WireGuard disabled) to 26.07.
First off, I want to say that Netgate is definitely on the right track with these new features, and I really appreciate the direction the platform is heading. However, after testing 26.07, I've decided to hold back on running it as our primary production build for now:
IDS/IPS Requirements (Snort3 / Suricata):
We have no immediate plans to deploy Snort3 or Suricata, so the enhancements on this front don't offer an immediate benefit for our current setup.
ThreatGate / ThreatDB:
Since ThreatDB is currently offline, list selection still has to be managed manually. I was expecting ThreatGate to handle list management automatically in a fully managed fashion. Until ThreatDB is fully operational, this feature doesn't feel ready for our primary workflow.
CoreDNS & DNS Architecture Changes:
I tested CoreDNS both in forwarding mode (to DNS Resolver/Unbound) and without forwarding using direct upstream DNS servers defined under System > General Setup.
While the implementation of groups (views) is definitely an interesting approach, the overall feature set feels a bit unpolished at this stage—especially when combined with the blocklist management issues mentioned above.
Furthermore, in General Setup, the removal of gateway selection per DNS server requires setting up explicit static routes for multi-WAN environments, which adds unnecessary complexity to our existing DNS routing setup.Nexus:
Nexus looks like a significant topic on its own, so I'll leave that for a separate dedicated thread to discuss its implications.
My Strategy Going Forward:
I've kept a ZFS snapshot / Boot Environment on 26.07. I plan to boot into it periodically off-hours to re-evaluate updates and track progress as these new features mature.For day-to-day production, our 26.03.1 setup remains rock-solid, and keeping it patched meets all our current needs while avoiding early-adoption risks.
Looking forward to seeing how 26.07 evolves and hearing how others are faring with CoreDNS and ThreatGate!
-
Thanks for the feedback. To clarify, both 26.03.1 and 26.07 have Nexus. If the concerns are just with Nexus then you can still upgrade to 26.07 and continue to use the old GUI - same as 26.03.1.
-
Yup that. You can upgrade to 26.07 to get fixes over 26.03.1 and just not use any of the new features.
-
Have to say, not impressed with he CoreDNS/ThreatGate/Nexus thing - difficult to know which is the major issue here.
ThreatGate is fiddly to set up, it’s not the pfBlockerNG replacement yet, not even close. I also found issues when removing some lists from ThreatGate that it some of them stuck in CoreDNSs blocking lists, and for some stuck in the firewall rules with no way to remove them as they were “managed” by ThreatGate. It desperately needs a tool to remove rules left over from ThreatGate/CoreDNS.
Add in overnight one of the trio (who knows which) got itself in a tailspin causing Nexus to crash over 300 times overnight (at least Pushover got notifications), CoreDNS to lose all it’s config, and ThreatGate to lose all it’s config as well, and 100% load on my pfSense router. However all the blocking rules it put in the firewall remained… With no way to remove them that I could find.
Result was this morning I woke up to everything being offline as nothing could get internet, and with the only way to rescue it being the boot environments (hurrah for them).
It’s far too early to even call it beta. It’s alpha release stuff.
-
@Vollans Thank you for the feedback!
-
Today I found swap usage, which shouldn't happen. It seems like there's some kind of memory leak or process spawning that is consuming the memory.
Rebooted the firewall and CoreDNS didn't launch on boot... had to log in and start it manually.
Back on 26.03.1 for now.
-
Same platform here (Netgate 6100, 26.07-RELEASE), Nexus in production for
a week. I can confirm your ThreatGate concerns with two measurements.Remote feeds are capped at exactly 4999 entries, silently. I ruled out a
source-format issue by generating the file myself: 6000 unique IPv4
addresses, one per line, no comments or duplicates, served locally over
HTTP. The table still loaded 4999. It is not a pf limit either, the
table-entries hard limit is 400000. This is Redmine 17029, open and
unassigned since 17 August.Practical impact: a GeoIP feed covering 37 countries needs about 36000
prefixes. ThreatGate loads 4999, and entire countries end up missing.
Splitting into several feeds does not help, each one independently hits
the same cap.Second point, related to Redmine 17030: since refresh_interval never
fires, a cron restarting the controller is the only way to keep feeds
current. But ThreatGate has no lighter reload path. SIGHUP is ignored,
and the API exposes no reload action. CoreDNS shares the process, so
every refresh costs about a minute of DNS outage.Snort 3 in the same release reloads its rules on SIGHUP without
interrupting capture. ThreatGate has nothing equivalent.Is anyone running ThreatGate feeds larger than 5000 entries?
Privacy Policy · Cookie Policy