pfSense CE¶
Aliases / Tables¶
Added: PHP shell playback script to modify Alias contents #11380
Authentication¶
Added: Copy button for Authentication Server entries #11390
Backup / Restore¶
Captive Portal¶
Certificates¶
Configuration Upgrade¶
Fixed: PHP error in
upgrade_212_to_213()
when upgrading certain IPsec tunnels #11801
DHCP (IPv6)¶
Fixed:
dhcp6withoutra_script.sh
does not get executed when advanced options are set #11883
DNS Forwarder¶
DNS Resolver¶
Fixed: Unbound Python Integration repeatedly mounts
dev
without unmounting #11456Fixed: Stale hostname registration data for OpenVPN clients is not deleted from the DNS Resolver configuration at boot #11704
Changed: Temporarily move back to Unbound 1.12.x due to instability on Unbound 1.13.x #11915
Dashboard¶
Diagnostics¶
Fixed: ARP Table populates hostname values using expired DHCP lease data #11510
Fixed: Sanitize OpenVPN Client Export certificate password in status output #11767
Fixed: Sanitize Captive Portal RADIUS MAC secret in status output #11769
Fixed: MAC address OEM information missing from ARP table #11819
Fixed: State table content on
diag_dump_states.php
does not sort properly #11852
Dynamic DNS¶
Added: New Dynamic DNS Provider: Mythic-Beasts #7842
Added: New Dynamic DNS Provider: one.com #11293
Added: New Dynamic DNS Provider: Yandex PDD #11294
Added: New Dynamic DNS Provider: NIC.RU #11358
Added: New Dynamic DNS Provider: Gandi LiveDNS IPv6 #11420
Fixed: Automatic 25-day forced Dynamic DNS update removes wildcard domain #11667
Fixed: Digital Ocean Dynamic DNS help text is incorrect #11754
Fixed: NoIP.com Dynamic DNS update failure is not detected properly #11815
Fixed: Dynamic DNS edit page incorrectly hides username field when switching away from Digital Ocean #11840
Gateways¶
Added: Input validation to prevent setting a load balancing gateway group as default #11164
Hardware / Drivers¶
High Availability¶
Fixed: Incorrect RADVD log message on HA event #11966
IGMP Proxy¶
Fixed: IGMP Proxy restarts unnecessarily after IPv6 gateway events #11904
IPsec¶
Added: GUI option to set RADIUS Timeout for EAP-RADIUS #11211
Added: Option to switch IPsec filtering modes to choose between
enc
andif_ipsec
filtering #11395Changed: Move custom IPsec NAT-T port settings to Advanced Options #11518
Fixed: strongSwan configuration always contains user EAP/PSK values #11564
Added: IPsec GUI option to control Child SA
start_action
#11576Fixed: Error when adding both IPv4 and IPv6 P2 under an IPv4 or IPv6 only IKEv1 P1 #11651
Fixed: Cannot disable IPsec P1 when related P2s are in VTI mode and enabled #11792
Fixed: IPsec VTI interface names are not properly formed for more than 32 interfaces #11794
Fixed: Applying IPsec settings for more than ~30 tunnels times out PHP #11795
Fixed:
ipsec_vti()
does not skip disabled VTI entries #11832Fixed: IPsec GUI allows creating multiple identical Phase 1 entries when using FQDN for remote gateway #11912
Fixed: Mobile IPsec advanced RADIUS parameters do not allow numeric values with a decimal point #11967
IPv6 Router Advertisements (RADVD)¶
Interfaces¶
Fixed: DHCP interfaces are always treated as having a gateway, even if one is not assigned by the upstream DHCP server #5135
Fixed: Interfaces page displays MAC Address field for interfaces which do not support L2 #11387
Fixed: CLI interface configuration without IPv6 leaves RA enabled #11609
Fixed: Incomplete PPPoE custom reset values lead to invalid cron entry #11698
Fixed: Error when changing MTU if the interface is used for both IPv4 and IPv6 default routes #11855
Added: VLAN list sorting #11968
L2TP¶
NTPD¶
Notifications¶
Fixed: Invalid HTML encoding in modal Notices window #11765
OpenVPN¶
Added: Allow the firewall to use DNS servers provided to an OpenVPN client instance #11140
Fixed: OpenVPN Wizard does not support gateway groups #11141
Added: Set Explicit Exit Notify to
1
by default for new OpenVPN client instances #11521Added: Support for Cisco AVPair
{clientipv6}
template in firewall rules returns by RADIUS #11596Changed: Set
explicit-exit-notify
option by default for new OpenVPN server instances #11684Fixed: OpenVPN does not clean up parsed
Cisco-AVPair
rules on non-graceful disconnect #11699Fixed: OpenVPN does not kill IPv6 client states on disconnect #11700
Fixed: OpenVPN client starts when CARP VIP is in BACKUP status when bound to Virtual IP aliased to CARP VIP #11793
Fixed: Certificate validation with OCSP always fails in
openvpn.tls-verify.php
#11830Changed: Update OpenVPN to 2.5.2 #11844
Fixed: OpenVPN client startup error if IPv6 Tunnel Network is defined in TAP mode #11869
Operating System¶
Routing¶
Fixed: IPv4 link-local (
169.254.x.x
) gateway does not function #11806
Rules / NAT¶
Added: Support for IPv6 firewall entries with dynamic delegated prefix and static host address #6626
Fixed: Disabling all interfaces associated with a floating rule causes the firewall to generate an incorrect pf rule #11688
Fixed: Input validation prevents creating 1:1 NAT rules on IPsec #11751
Fixed: Invalid combinations of TCP flag matching options cause
pfctl
parser error #11762Fixed: Port forward rules only function through the default gateway interface,
reply-to
does not work for Multi-WAN (CE Only) #11805Fixed: Error loading rules in certain cases where an interface is temporarily without an address #11861
Fixed: NAT 1:1 fail to validate aliases #11923
Traffic Shaper (ALTQ)¶
Traffic Shaper (Limiters)¶
Upgrade¶
Fixed: Language presented to user during upgrade is misleading #11897
Web Interface¶
Added: Replace HTTP links with HTTPS in the GUI #11228
Fixed: Ambiguous text in help and input validation error for system domain name #11658
Fixed: PHP error if
PHP_error.log
file is too large #11685Fixed: RAM Disk Settings shows Kernel Memory at
0
Kb and does not allow the user to create RAM disks #11702Fixed: HTTP Referer error message text is incorrect #11873
Fixed: Missing
/0
subnet when cloning repeatable CIDR mask controls #11880Fixed: Update NGINX to address CVE-2021-23017 #12061
WireGuard¶
Fixed: Ignore WireGuard configurations under
<installedpackages></installedpackages>
#11808