Netgate^(®) is pleased to announce the release of a Beta of pfSense Community Edition version 2.9. Now it’s your turn to help us test this latest iteration of our popular open-source firewall and services platform software. This beta release brings a host of new features, enhancements, and fixes, and your feedback is crucial to ensuring a rock-solid final release.

Feature Highlights

This Beta software includes a large number of security and feature enhancements. Some highlights include:

SSH Algorithms: This release includes several changes to algorithms for the SSH daemon for key exchange, encryption, and message authentication. These changes increase security by including post-quantum key exchange algorithms and by removing older and weaker algorithms.

TLS Certificate Strength: The version of OpenSSL in this release further tightens certificate requirements and removes support for certain weak properties. For example, if a TLS server certificate for a service such as the GUI has a weak key (<2048 bits), the service may fail with an error such as “key too small”. This version of pfSense software checks the GUI certificate during the upgrade process and will re-generate a new GUI certificate if the current certificate is invalid, expired, or weak.

TLS Certificate Auto-Renew: This version of pfSense software can automatically renew TLS server certificates which are self-signed or signed by an internal CA stored in the pfSense software configuration. Automatic renewal is a per-certificate option, and pfSense software automatically enables this option for the GUI certificate when possible. When automatically renewing a certificate, pfSense software uses the latest strict security options to ensure the certificate meets current standards.

Endpoint-independent Port Restricted Cone Outbound NAT: This version includes partial experimental support for “Port Restricted Cone” endpoint-independent outbound NAT. “Port Restricted Cone” NAT mappings attempt to preserve port and external address mappings for clients when speaking to multiple remote hosts, but in a dynamic way that does not rely on static port NAT. This helps avoid issues with multiple local clients using the same source port to the same remote host.

In addition to the features listed above, this Beta software includes critical security updates for WireGuard (CVE-2026-58085), and other security enhancements. This Beta software also contains over 150 other software enhancements.

Call for Testing

Testing of this Beta software is essential. Testing is the most effective way to ensure that the software is robust and reliable for all users, given the diversity of their environments and configurations. By downloading and testing this Beta software, and providing feedback on any issues, our users can play a vital role in improving the software for everyone.

Caution

As with any beta software, pfSense CE 2.9 Beta is not yet production-ready. Expect some rough edges - that’s where you come in! Please avoid deploying it in critical environments until the stable release is available.

The pfSense CE 2.9 Beta is a milestone in our ongoing mission to deliver a powerful, flexible, and free networking solution to users worldwide. Your participation in this testing phase directly influences the quality of the final product. 

Release Notes:

https://docs.netgate.com/pfsense/en/latest/releases/2-9-0.html

Netgate^(®) has made a new Release Candidate for pfSense^(®) Plus version 26.07 available for testing. 

This release marks another significant step forward in the Netgate Nexus controller architecture, which is our new Go-based controller that is replacing the legacy PHP GUI and serving as the modern foundation for pfSense software. Netgate Nexus continues to deliver further improvements and new feature development, bringing exclusive capabilities that enhance performance, scalability, and functionality to pfSense Plus.

Key new features exclusive to the Netgate Nexus controller include:

CoreDNS: A high-performance, integrated DNS component that handles DNS-based tasks with exceptional speed and efficiency, powered by a new and exclusive Netgate plugin called rexdns.

Threatgate: A powerful, high-performance component that manages bulk lists of addresses and domains for firewall rules, aliases, and CoreDNS groups. Administrators can block these lists outright or create custom rules based on their content.

Threatgate and CoreDNS were built to integrate tightly together, enabling rapid processing and utilization of even massive lists - all while maintaining excellent performance on small, resource-constrained devices.

Snort Version 3: The updated version of the popular open-source intrusion prevention system (IPS), featuring multi-threading support, and a faster rule syntax, is now available exclusively via the new Netgate Nexus controller GUI.

In addition to the features listed above, this release candidate includes critical security updates for WireGuard (CVE-2026-58085), and other security enhancements.

Other fixes and enhancements were made to:

• DHCP
• DNS Resolver
• DynamicDNS
• Gateways and Monitoring
• IPsec
• VXLAN Interfaces
• OpenVPN
• Firewall Rules and NAT
• Traffic Shaper
• Wireless

This release includes numerous updates, bug fixes, and enhancements, with more to come as pfSense Plus and Netgate Nexus development accelerates.

Using the New GUI

The Netgate Nexus controller is the future of the pfSense Plus GUI.

Whether you manage a single pfSense Plus firewall or an entire fleet, the Netgate Nexus controller delivers a modern, refreshed management experience built for the way you work today.

Getting started is simple:

1. Go to System > Advanced.
2. Switch to the Netgate Nexus tab and enable it.
3. Log in to Nexus on port 8443 of your firewall.

More detailed documentation can be found here.  Start using it today and get immediate access to the new features and capabilities coming to pfSense Plus. 

Note: Virtual machines as well as some third-party platforms may not support the new GUI due to missing machine information required to correctly run the software.

Call for Testing

Testing of this release candidate software is essential. Testing is the most effective way to ensure that the software is robust and reliable for all users, given the diversity of their environments and configurations. By downloading and testing this release candidate, and providing feedback on any issues, our users can play a vital role in improving the software for everyone.

Release Notes:

https://docs.netgate.com/pfsense/en/latest/releases/26-07.html

Netgate^(®) announces the release of pfSense^(®) Plus software version 26.03.1. This maintenance software release contains over 20 fixes and enhancements, including security improvements. All pfSense Plus software users are encouraged to upgrade to this new version. 

Key security improvements include fixes for:

• Potential Stored XSS in diag_arp.php when using ISC DHCP
• Potential XSS in RSS Widget feed content post titles
• Potential XSS in Captive Portal widget
• Fixes for vulnerabilities discovered in the DHCP client
• Several base system packages were updated to address various upstream security issues.

Additional areas of improvement include:

• Aliases/Tables
• LDAP Authentication
• Captive Portal
• Console Menu
• Dashboard
• IPsec
• OpenVPN
• Firewall Rules/NAT

Fixes and improvements exist in other areas as well.  Please see the Release Notes for detailed information.