OPNsense 24.1.8

The OPNsense package is a firewall with extensive options. It is based on the FreeBSD operating system and is originally a fork of m0n0wall and pfSense. The package can be set up entirely via a web interface and has support for mfa, OpenVPN, IPsec, CARP and captive portal, among other things. In addition, it can apply packet filtering and has a traffic shaper. The developers have released OPNsense 24.1.8 and the release notes for that release can be found below.

OPNsense 24.1.8 released

The endless loop packet read in the new dhcrelay daemon has been fixed. A new kernel is included in this release bringing the latest stable/13 state in the relevant networking areas. A number of small changes have also been made. Thanks for all the reports and support!

To spread the news… 24.7 will be based on FreeBSD 14.1. Stay tuned.

Here are the full patch notes:

• system: fix regression in gateways migration causing far gateway option to be set incorrectly
• system: work around fatal password_hash() change in PHP 8.2.18
• system: move net.inet.icmp.drop_redirect sysctl to automatic mode
• system: add Google Drive configuration as an XMLRPC sync target
• interfaces : detect and ignore “detached” state for IPv6
• interfaces: remove unused imports from socktat list
• firewall: use the new $.replaceInputWithSelector() for source/destination networks in MVC filter pages
• firewall: fix empty rule label rendered as “null” on sessions page
• ipsec: fix faulty “-” usage in URIs
• isc-dhcp: take into account that multiple ia-pd can be delegated
• kea-dhcp: simplified the controller code
• unbound: change blocklist processing in _blocklist_reader()
• unbound: allow RFC 2181 compatible names in query forwarding
• mvc: silence spurious validation message when explicitly asked to ignore them
• ui: prevent vertical modal overflows and instead present a scrollbar
• ui: add $.replaceInputWithSelector() action
• ui: handle static page CSRF without Phalcon
• plugins: os-caddy 1.5.6
• src: pfsync: fix use of invalidated stack variable
• src: pfsync: cope with multiple pending plus messages
• src: ipfw: skip to the start of the loop when following a keep-state rule
• src: bridge: use IF_MINMTU
• src: bridge: change MTU for new members
• src: ethernet: support ARP for 802 networks
• src: ethernet: fix logging of frame length
• src: debugnet: fix logging of frame length
• src: wg: use ENETUNREACH when transmitting to a non-existent peer
• src: fib_algo: lower level of algorithm switching messages to LOG_INFO
• src: libpfctl: fix incorrect pcounters array size
• src: pf: always mark states as unlinked before detaching them

< li>src: vxlan: add checking for loops and nesting of tunnels

• src: igc: increase default per-queue interrupt rate to 20000
• ports: dhcrelay 0.5 fixes endless loop on packet read
• ports: hyperscan 5.4.2
• ports: libxml 2.11.8
• ports: ntp 4.2.8p18
• ports: openssl fix for CVE-2024-4603
• ports: phalcon 5.7.0
• ports: py-duckdb 0.10.3