r/PFSENSE

Just looking to confirm if anyone else is finding that the repo is down. Had two installs fail and pkg.pfsense.org not resolving in dns

I have an 8G symmetric connection and I have followed the instructions here to manage bufferbloat. All defaults are untouched and Queue length is 5000 as per guidance and bandwidth limited to 7000Mbits/s

There issue I have is when enabled, my speeds drop to 4Gbps Up/Down. Hardware-wise, my CPU is an Intel Core i5-9600T and I'm using an Intel X550-T2 NIC for WAN/LAN. Is this a CPU bottleneck?

Before limiter:

before

After Limiter

after

I have email notifications setup but

1. Never get emailed when a package has an update

2. Never emailed when system patches are released.

How can we get notifications for at least patches?

PS if you didnt know, CE has new patches released for it

Yesterday we renewed our lease lines and got a new public IP.

I created the new interface and default WAN gateway, traffic is flowing correctly and there has been no effect to our RDS and WireGuard services.

Unfortunately, the Alcatel PBX we host onsite receives inbound calls to all but our main DDI and on those lines that the calls are received the callers can be heard but their voice cannot be heard by the recipient. After 10-11 seconds the call will then drop showing “call failed” for the inbound caller.

Initially I changed the destination address on our TCP and UDP rules in NAT to reflect our new public IP. I also updated the Outbound Mappings to the new IP.

This is when during testing I discovered the above issue. So I rang the comms provider and confirmed that the SIP Trunks and PBX ports were correct against the aliases set but they were set correctly.

I have been running test packet captures and can see the following packets from the DDIs that do connect when rung:

INVITE
100 TRYING
183 SESSION PROGRESS
180 RINGING
200 OK
ACK SIP
BYE SIP
200 OK (BYE)

I have checked the states and cannot see any references of our old public IP in source or destination when using filter expression. I did not want to clear the states without confirmation of this being the issue as I was unsure of the knock-on effect (I only have 1 years experience) with pfSense.

I have been through Netgates Firewall Best Practices for VoIP video and our setup matches the recommended setup (albeit this is from 2017)

The only other thing I noticed was that the previous public IP used by the outgoing NAT had been set up as a Virtual IP. We now only have 1 public IP from our ISP so I have entered that directly as the Destination Address on the Port Forward and NAT Address on the Outbound Mapping.

Any assistance or advice would be greatly appreciated! :)

UPDATE: I would love to claim I fixed this, I spent most of the night reviewing the rules, verifying the NAT rules and outbound and listening to my own voice via packet traces (I didn’t realise you could do that with SIP!)

I walk in this morning and it works… I am thinking maybe I missed a state referencing the old public IP or there is some sort of DNS’ing with our new public IPs that causes issues with VoIP?

I’m glad it’s fixed, but annoyed I couldn’t solve the mystery.

I was going to wait a couple of months; let thing gets ironed out a little bit. Then I figured out that you can upgrade to 26.07 and not use any of the new features exclusive to the Netgate Nexus controller.

Not sure if everyone knows that?

I used my Proxmox vm for that, tried the Nexus controller and didn't like it *yet*. So I turned if off and am back to the original. I will run this vm for a bit of testing, then upgrade my 6100.

All good!

After upgrading to pfSense Plus 26.07 on my custom box running an AMD Ryzen CPU, idle temperature increased from roughly 40C to 60-65C while the CPU was 99% idle.

FreeBSD 16 enables the new hwpstate_amd CPPC support. On this system, every logical CPU showed desired_performance set to maximum and EPP 0 by default. FreeBSD documents this as the intentional initial behaviour to avoid performance regressions:

https://www.freebsd.org/status/report-2026-01-2026-03/cppc/

I set desired_performance=0 (autonomous mode) and EPP to 128. Then running some tests, including 3Gb/s of sustained traffic through the box the CPU still boosted appropriately. PPPoE, Suricata, Unbound, ntopng, and gateway monitoring remained healthy during the test. CPU went up to 7% and only raised the temparature to 43C, which immediately went back to 41C.

Just posting this as an observation and am curious whether anyone else running 26.07 on recent AMD hardware is seeing the same change in idle temperatures.

FreeBSD shipping a new CPPC driver with every supported CPU defaulting to maximum performance policy, before powerd or a supported management path can actually control it, seems like a poor production default for systems that could spend a lot of their time at idle.

First, let me start by thanking the pfSense team.

I have completed my installation of the latest pfSense+ version. And it is working well - thus far. But as anyone who has done this before knows, new versions often lose installed packages. This is the case for the "official" pfSense API. I suspect that

Second, I want to thank those responsible for the pfSense REST API.

I have used this API to manage my router since I deployed 2026.03.1. And the API is great! When coupled with the pfSense Manager app (on my mobile device), I can do almost all management tasks remotely. This is monumental for me.

But as I have now moved onto the bleeding edge support case (i.e., I just installed a new release only a day after its official release. So, as of this moment, I no longer have official / supported API access. And I hope everyone knows that these things take time. I certainly know this. But is anyone aware of when 26.07 will be supported on the latest release? I'm not in a hurry. I can hold my horses. But I was wondering if a tentative date (or set of milestones) has been set.

That's why 2.8.1 just had 22 patches released if you use the patches packet in packet manager. And then there is a 2.9 beta available for those that want to live dangerously. Obviously these are all signs that this version of PFsense is dead and Netgate has abandoned it. We should all move on because they only care about Plus now.

/s for days. Thank you Netgate. Keep up the good work.

I finally got 5Gbps fiber internet in my area with AT&T fiber and I want to be able to support it after my 5G WAN port on the ONT. I have an older Protectli FW1 that supports 1Gbps, but want to have something that is rack mountable, preferably 1U. The setup I want is AT&T ONT > Firewall Build > 10GB switch > Internal Router/Devices/Proxmox Home Lab.

Want to leave it up to the community for best recommendations and ideas. What y'all got?

This is a bit of weird one and I don't have an explanation for this.

Have had a couple of pfSense units, a Watchguard XTM 515 running pfSense CE and currently using a XG-7100 1U on pfSense Plus.

Installs and updates would be fine when I was on Virgin Media (or using a relatives Virgin Media connection).

However, ever since I've switched from Virgin Media cable internet to FTTP via CityFibre here in the UK, updating any pfSense device on this connection has been like molasses, downloading at around 1Mbit/sec, when it's pulling the packages from the Negate repo. I have changed CityFibre ISPs during that time, including going from PPPoE to DHCP WAN connection.

Everything else about the pfSense units has been fine otherwise and I'm able to leverage the full speed (500Mbit/sec Symmetrical) of my connection.

Any ideas?

I got a free pfsense plus homelab license back in late 2023 under their now discontinued program. It came with the full commercial version but only offered community level support. After pfsense discontinued the program they indicated that they would be grandfathering access to to the ongoing free license tier indefinitely for existing users of the program.

Well, looks like this policy may have come to an end. The mTLS certificate that validates access to the pfsense+ package repository appears to have stopped working for me on August 12.

Attempting to force an update of the cert yields:

>>> Updating repositories metadata...failed

Is there anyone else still on one of these old homelab licenses experiencing similar issues?

The cost for a commercial license is a bit too steep for me, especially considering the exchange rate where I'm from, so it's back to CE

Is migrating from Plus to CE using a saved config file relatively painless?

After a review of the new UI, I already discarded it :

1-Despite SAML is listed as a type of Authentication Server, we can not configure one...

2-I use HAProxy for both Internet and local services but HAProxy is nowhere to be found in the new UI...

3-Despite I fixed the problem about the missing serial number in the BIOS of my Proxmox VM, the new UI keeps complaining that it is not licensed...

4-Basic tasks like package management are not accessible because the new UI says that this feature is restricted to properly licensed installations

5-Same for update management

So with all of this already identified, it is clear that I will have to use the original UI for many basic and essential tasks. As such, there is no reason to log in and out from new to old to new according to what I need to do. That new interface is far to be complete and ready, so I will stay with the good old one...

EDIT: Great! Now it broke my entire licensing, even in the old UI. I can no longer check for updates because pfSense says that my system is not properly licensed but when I go in Register in the System menu, it says that I do not need to register because the installation is already recognized as legitimate.

Really, do not even try the new UI or you may brake and lose your license like me!

Experiencing the new user interface here and I am surprised by what I discovered. One one side, pfSense finally supports centralized authentication and SSO but on the other side, it has been implemented with SAML instead of OpenID...

My Keycloak server supports SAML as well and I do have 2 softwares that are still using SAML only. But the truth is that OpenID replaced SAML a long time ago and that the vast majority of tools are now using it.

So... good to have half-a-solution instead of nothing for now but still, the real need is for OpenID and we are still waiting for that one. I have no clue why Netgate did the work for an outdated technology instead of the new standards but well...

EDIT: It looks like I celebrated too quickly... The UI shows about SAML authentication servers but you can not create a new one...

I am experiencing occasional internet outages that last maybe 15-20 seconds on my network. It seems to happen randomly once every few of hours, maybe 3-5 times most days, but not everyday. It's long enough to kick me off of online games like MTG Arena and Overwatch and interrupts my Twitch stream but it comes back quickly. This has been going on for a few months. It's been annoying, but it isn't super often.

The network is pretty simple:

• Brand new Netgear modem. (It happened on two modems)
• Netgate PFSense firewall 5100
• "Big" 16 port switch, small 8 port switch for a few more devices (I've replaced both with equally "dumb" switches)
• Google dot wifi AP
• 1.1.1.1 and 1.0.0.1 DNS servers on the Netgate.

I suspected my local devices but they all drop at the same time. I suspected my switches: I have swapped them all to spares and the issue continues.

I look at the pfSense Status/System Logs/System/General and it never shows errors during the blips. I look at the Netgear Modem and it doesn't have any errors in the event log during the outage. I am sure there is more I can ask the devices but I don't know what.

My only clue/suspicion is that this started happening after adding a HAProxy reverse proxy for a Jellyfin. ...but I've removed the DDNS entry and the outages continue. I'm not sure how I can rule out the ISP being flaky.

What other logs can I look at? Can I run any scripts somewhere to help diagnose? Sorry if there is too much or too little relevant info.

Thanks in advance for any suggestions!

Been trying the new GUI out, and honestly can't say I'm a fan. Anyone else? Looks & feels very clunky to me.

Text wrapping in the description for interface rules is ugly IMO, editing the firewall rule seems all over the place as well.

Or maybe I should just write better rule descriptions? You tell me. I can't find any way to expand the region that shows all the rules as well.

https://preview.redd.it/t1c0snfoilih1.png?width=1065&format=png&auto=webp&s=22b0f090b30fc6b93cb1b4f12929c6fdc192e8f4

Hi,

Reading the announcement they state "Our goal is for everyone to be using the new GUI by the end of the year" but then they go on to state "Virtual machines ... may not support the new GUI due to missing machine information"

Does this mean virtual machines are/may not be supported in the future?

The new pfSense Plus GUI is honestly impressive at first for those of us who have been using pfSense for more than 10 years. However, after using it for a while, the impact is not quite as strong.

One issue I find particularly frustrating is the “token is expired” message appearing every second. I understand that the token has expired, but having the notification appear so frequently feels excessive.

As for the traffic graphs module, I am not fully convinced yet.

This is only my personal opinion as someone who has been using pfSense since version 1.0.1, but I still find the little brother GUI to be better overall. Again, I am not trying to start a debate or create conflict; this is simply my own perspective. I do believe the new GUI will continue to improve over time, but so far, it has not been a “wow” experience for me.

I still need to test the API, and that is one area where I would give you a 10.

Thank you for your work, team.

Annoying