Now Available: pfSense CE 2.9.0 Release

[pfGeorge]

Netgate is excited to announce the release of pfSense Community Edition (CE) software version 2.9.0, a major step forward for the world’s most trusted firewall, router, and VPN platform.

This release introduces numerous features, including several previously exclusive to pfSense Plus, as well as key enhancements, bug fixes, and critical security updates.

Key Highlights Include:

SSH Algorithms: The inclusion of post-quantum key exchange algorithms
TLS Certificate Strength: Tightens certificate requirements and removes support for certain weak properties
TLS Certificate Auto-Renew: pfSense can automatically renew TLS server certificates which are self-signed or signed by an internal CA stored in the pfSense software configuration.
New NAT Mode: Includes partial experimental support for “Port Restricted Cone” endpoint-independent outbound NAT
Critical Security Fixes: This release includes multiple XSS and denial of service related fixes

This Release software includes critical security updates for WireGuard (CVE-2026-58085), as well as over 150 other security fixes and enhancements.

Blog Post:
https://www.netgate.com/blog/netgate-releases-pfsense-community-edition-version-2.9.0

Release Notes:
https://docs.netgate.com/pfsense/en/latest/releases/2-9-0.html

Thank you to our community and customers who continue to support the pfSense project through hardware purchases, TAC, cloud subscriptions, and services. Your support makes this all possible.

[slu]

Thank you Netgate!

[LHoust]

@pfGeorge

As it was with 26.7 Plus, with a Fresh Installation of 2.9.0 CE on my ZimaBoard 1 (Celeron N3450), the System Halts with a Kernel Panic!!!

Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 02
fault virutal address = 0x20
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff8051d28d
stack pointer = 0x20:0xffffffff83d5ac00
frame pointer = 0x20:0xffffffff83d5ac00
processor eflags = interrupt enabled, resume, IOPL = 0
current thread = 0/100000 (kernel/kernel)
rdi: fffff800012d3de0 rsi: 0000000000000000 rdx: 0000000000000004
rcx: 000000000000004 r8: 0000000000000040 r9: fffffe0008636d00
rax: 0000000000000000 rbx: 0000000000000008 rbp: ffffffff83d5ad00
r10: 0000000000000000 r11: 000000005f42535f r12: 000000000000000
r13: ffffffff816b8138 r14: 000000000000028 r15: fffff800012d3c58
panic: page fault
cpuid = 1
time = 1
KDB: enter: panic
[ thread pid 0 tid 100000 ]
Stopped at kdb_enter+0x33: movq $0,0x20cb242(%rip)

[SteveITS]

@LHoust Did you set https://docs.netgate.com/pfsense/en/latest/releases/2-9-0.html#hardware-errata ?

[LHoust]

@SteveITS

That specifically mentions Celeron J and workarounds are outside of my "Scope"...

[TommyMoo]

@pfGeorge Thank you netgate, my update from 2.8.1 went all well, also my VPN WireGuard Tunels and 4 Gateways, are UP and running

[revengineer]

Upgrade from CE 2.8.1 went mostly well. There is an issue with PIMD, and I have posted the issue and temporary solution in the forum for upgrade issues.

[tb404]

Upgraded from 2.8.1 to 2.9. Everything works perfectly apart from Huawei ME909s-120 4G modem no longer being detected on PcEngines APU2. Maybe something to do with FreeBSD 16.0-CURRENT?

[Waqar.UK]

Whenever I try to update, pfsense webgui says "error contacting servers".
Server overloaded?

[bimmerdriver]

I updated this morning and I've been seeing Offline (packet loss) and Pending status on both WAN_DHCP and WAN_DHCP6 ever since. It's worse on WAN_DHCP6. Going to Interfaces / WAN / Save / Apply restores them to Online. Before the update, there were no such problems.

[Waqar.UK]

@bimmerdriver

How do I check for this?

[bimmerdriver]

I had to restore 2.8.1 because 2.9.0 became increasingly unstable and non-functional. I will create a post in Home / pfSense Software / Problems Installing or Upgrading pfSense Software.

[Clouseau]

REST API documentation should be upgraded too!

https://pfrest.org/INSTALL_AND_CONFIG/#supported-pfsense-versions

That document gives this (old) url for package install: pkg-static add https://github.com/pfrest/pfSense-pkg-RESTAPI/releases/latest/download/pfSense-2.8.1-pkg-RESTAPI.pkg

This will lead to failure:
Fetching pfSense-2.8.1-pkg-RESTAPI: .......... done
Installing pfSense-pkg-RESTAPI-2.10_2...
pkg-static: wrong architecture: FreeBSD:15:* instead of FreeBSD:16:amd64

Failed to install the following 1 package(s): https://github.com/pfrest/pfSense-pkg-RESTAPI/releases/latest/download/pfSense-2.8.1-pkg-RESTAPI

Tried this one => working
https://github.com/pfrest/pfSense-pkg-RESTAPI/releases/latest/download/pfSense-2.9.0-pkg-RESTAPI.pkg

Could you make this as an official package ?

[LHoust]

@SteveITS said in Now Available: pfSense CE 2.9.0 Release:

@LHoust Did you set https://docs.netgate.com/pfsense/en/latest/releases/2-9-0.html#hardware-errata ?

After following the CE 2.9.0 Hardware Errata, I can now confirm that adding hint.acpi_spmc.0.disabled=1 in /boot/loader.conf.local also solves that Kernel Panics that my ZimaBoard (Celeron N3450) was experiencing, after I restored my CE 2.8.1 into a "Fresh" CE 2.9.0 Installation!

That said I am now "Challenged" on how to add this Loader Tunable to my Saved CE 2.9.0 Configs, such that I would NOT have to Manually re-create this Loader Tunable within /boot/loader.conf.local (if it does NOT already exist)...

I tried creating a System Tunable as hint.acpi_spmc.0.disabled=1, although through what I observed today, that was unable to create /boot/loader.conf.local, (unless I manually create that file and add that entry myself)!!!

What am I missing here???

[TommyMoo]

@LHoust Hello, I add my bootloader "commands" into /boot/loader.conf

I have deactivated admin account and made a own account (in Admin Group), thats why I have to use sudo to execute shell commands with appropiate Admin rights...

I would login to pefsense via SSH and then type->
sudo nano /etc/loader.conf

and place the desired line (command) into it in a single line

then in nano, do a ctrl O for saving the file.

For me, they persist there, and stay after rebooting...

[SteveITS]

https://docs.netgate.com/pfsense/en/latest/config/advanced-tunables.html#managing-loader-tunables

@LHoust
"Loader tunable values must be set before the kernel boots and user-defined loader tunables belong in /boot/loader.conf.local"

"Loader tunables are not currently manageable in the GUI"

@TommyMoo said in Now Available: pfSense CE 2.9.0 Release:

nano /etc/loader.conf

/boot/loader.conf? The above page says one must use .local so it's not overwritten when upgrading.

[TommyMoo]

@SteveITS OK, Thanks for the correction...

[TommyMoo]

@LHoust I was corrected, sorry, you have to ssh into pfsense, and do a

nano /boot/loader.conf.local

and put your command there, do a ctrl O for saving it, after you place the command into /boot/loader.conf.local

[LHoust]

said in Now Available: pfSense CE 2.9.0 Release:

@SteveITS said in Now Available: pfSense CE 2.9.0 Release:

@LHoust Did you set https://docs.netgate.com/pfsense/en/latest/releases/2-9-0.html#hardware-errata ?

I tried creating a System Tunable as hint.acpi_spmc.0.disabled=1, although through what I observed today, that was unable to create /boot/loader.conf.local, (unless I manually create that file and add that entry myself)!!!

What am I missing here???

Sorry my question was NOT worded very well, actually I what I wanted to ask was:

What am I missing here: In terms of how have hint.acpi_spmc.0.disabled=1 included within a Saved CE 2.9.0 Config, such that I would NOT have to manually create that /boot/loader.conf.local Entry after Restoring a CE 2.9.0 Config???

Given my addition of a System Tunable Entry, did NOT work...

[SteveITS]

@LHoust I'm not sure there is a way to save/restore that file...? Maybe use the cron package and have it create that file at boot, which is after boot but at least it's created. How fast does it die?