Troubleshooting Boot Issues

The errors in this article would happen during bootup, typically the first boot either from the install media or immediately after installation. If the system was up and running but then developed a boot issue with no changes in the software/OS, it isn’t likely to be related.

Booting with an alternate console

To boot a different console, first get to a loader prompt. Either choose the menu option from the boot menu, or when Hit [Enter] to boot immediately, or any other key for command prompt. is seen during the boot process, press space or another key.

Once at the loader prompt, type the following to boot with the serial console active:

set console=comconsole
boot -v

Similarly, if a serial memstick image is used that prefers the serial console, the video console can be used instead as follows:

set console=vidconsole

Booting from USB

If booting fails from a USB 3.0 port and the above does not help, try a USB 2.0 port with the same delay settings. Similarly, if it fails with a USB 3.0 thumb drive, try a USB 2.0 thumb drive. Drive capacity can also make a difference, where some older hardware may not be able to boot large capacity USB drives.

If the boot stops with a mountroot error while booting off the installation disc, usually with USB CD/DVD drives, escape to the loader prompt and run the following:



pfSense® software applies this change already when it detects the need, but there may be some edge cases where it should be handled manually.

At which point the boot will continue normally and a normal installation will be possible.

If running permanently from a medium that requires this delay, edit /boot/loader.conf.local and insert the following line:"10000"

Multiple Disk Boot Issues

If a system has multiple disks and pfSense software has been installed on both, it is possible they may conflict in one or more ways. For example, this can happen if an older disk was left in place after adding a new disk of a different type and reinstalling to the new disk.

In these situations best practice is to remove the unused disk but that is not always possible. For example, if the original installation was using an embedded disk such as eMMC. If the disk cannot be removed, then the next best solution is to clear the metadata from the unused disk.

A common way multiple disks conflict is if they both use the same ZFS label. In that case it is unpredictable which ZFS pool will be used by the OS and it may change depending on the boot order. Another way is if the OS boots the kernel from one disk but mounts the other disk in the operating system, leading to a situation where the installed OS appears up-to-date but is booting with an outdated kernel.

Identify the Disk

To clear the metadata safely, first identify the unused disk. This may take some investigation, but typically disks are listed in the full boot log output in /var/log/dmesg.boot, the output of sysctl kern.disks, along with other OS commands such as geom list disk and gpart list. In some cases it’s clear which is which, such as when using an add-on SSD instead of eMMC, where the eMMC disk is named mmcsdX and the SSD is nvdX or adaX.


If the unused disk cannot be definitively identified, take a backup, clear the data from all disks, and then reinstall.

In these examples the unused disk is mmcsd0.

Clear the Disk

The commands in these examples must be run from a console or SSH shell prompt. Do not attempt to execute these commands from the GUI. The best practice is to run them from the console and to have installation media on hand in case a reinstall is necessary.


If any of the commands generate an error, boot pfSense software installation media and perform the commands from a shell launched through the installer menu . When booted from install media, the disks in the device will not be mounted and can be safely cleared.

Wipe Metadata

The quickest and easiest way to wipe a disk is to clear its metadata.

The following commands clear the disk partition metadata, ZFS metadata, and also wipe the start of the disk to clear the partition table and other data at the beginning of the disk. Depending on the situation it may only be necessary to clear the ZFS metadata but it’s safer to clear it all.

### Clear the ZFS label (exact partition may vary)
# zpool labelclear -f /dev/mmcsd0p4

### Clear the partition metadata
# gpart destroy -F mmcsd0

### Wipe the first 1MB of the disk
# dd if=/dev/zero of=/dev/mmcsd0 bs=1M count=1 status=progress


Alternately, skip the first two commands and omit the count=1 on dd to wipe the entire target disk from start to end.

Wipe Start and End of Disk

Another tactic is to wipe only the start and end of the disk. However, this approach is a much more complicated process as it involves calculations based on the sector size and number of sectors on the disk:

### Wipe the first 1MB of the disk
# dd if=/dev/zero of=/dev/mmcsd0 bs=1M count=1 status=progress

### Wipe the last 1MB of the disk
# dd bs=`diskinfo mmcsd0 | awk '{print $2}'` \
     if=/dev/zero \
     of=/dev/mmcsd0 \
     count=`diskinfo mmcsd0 | awk '{print ((1024 * 1024) / $2)}'` \
     seek=`diskinfo mmcsd0 | awk '{print $4 - ((1024 * 1024) / $2)}'` \


Be sure to replace every instance of the target disk in each command, as the disk is referenced numerous times to obtain the necessary calculation numbers.

GPT Boot Issues

Some systems may fail to boot a 2.4 memstick because they do not fully support booting from GPT or they are particular about the layout or other attributes.

In these cases, the memstick can be modified using another firewall running pfSense software version 2.3 or later, or with a FreeBSD 10.x or later system.

Insert the memstick into the device with the pfSense or FreeBSD installation and check the system log or dmesg output to find the device name, such as da1.

First, try to set the partition on the memstick active:

gpart recover da1
gpart set -a active da1

Remove the memstick and attempt to boot the memstick on the target hardware. If it works, be sure to only use compatible options in the installer. In this case, if the BIOS requires an active GPT partition then either of the following installer choices will work:

  • Auto (UFS) requires the Partition Scheme BSD (BSD Labels)

  • Auto (ZFS) requires the Partition Scheme GPT + Active (BIOS)

Other platforms may need more changes to the memstick, including:

gpart bootcode -b /boot/pmbr -p /boot/gptboot -i 2 da1
gpart set -a bootme -i 2 da1

In this case the hardware may not be capable of booting ZFS, but use the same option above for UFS with BSD Labels which should work.

In either case, depending on the BIOS and hardware capabilities, similar modifications may be made to the installation target disk to use other partition schemes not listed above, but that has not been tested internally.

BIOS/Disk Errors

  • If after installation, a “cannot load kernel” error is observed, or the firewall hangs at the spinner (/):

    • Make sure BIOS is up to date

    • Reinstall but do not check the packet mode option during boot block installation process

    • Set the HDD mode in BIOS to LBA (don’t use “auto”, the detected geometry is different if it is set to auto and it fails)

    • Set the HDD mode in BIOS to CHS if the above fails

    • Set AHCI mode in the BIOS

  • Try using multiple partitions, one small one (~4GB) for / and another for /usr using the rest of the disk.

  • If the installer fails to start correctly (system reboots), try the following (attempt each substep, then rerun the installer each time):

    • Make sure BIOS is up to date

    • Change the hard drive ribbon/SATA cable

    • Force a slower speed in the bios for the channel

    • Boot from another disk and run: (note that ad0 is the first ata hard drive):

      # dd if=/dev/zero of=/dev/ad0 bs=8k count=16
      # fdisk -I ad0
  • If all those fail…

    • Partition from a FreeBSD Live CD or Linux

    • Different hard drive

    • Different hardware entirely that isn’t prone to legacy booting issues

DVD Errors

  • If the installer disc starts to boot but hundreds of errors are printed, try:

    • Make sure BIOS is up to date

    • Use a USB memstick instead

    • Burn the disc at a slower speed

    • Change the DVD drive cable

    • Different DVD drive

Boot Blocks/Loader Issues

  • If a read error occurs during boot, please see this Boot Error.

  • If FreeBSD will boot but not pfSense, try booting from a FreeBSD Live CD and running the following (More Info):

    # fdisk -B -b /boot/boot0 /dev/ada0
    # bsdlabel -B /dev/ad0as1


    ada0 is the first hard drive in that example

Vendor-Specific Issues

  • Certain Dell Blade servers may hang at boot if the system’s virtual USB media is enabled. Disable the virtual media in the BIOS and then it should boot normally.

  • Certain systems running Hyper-V on AMD processors may need to do the following:

    Escape to the loader prompt during bootup and run:

    set hw.clflush_disable=1

    At that point, boot the rest of the way and install pfSense software. After installation, add the following line to /boot/loader.conf.local:


If all else fails, Netgate offers Netgate TAC and hardware through the Netgate Store that is pre-loaded with pfSense Plus software.

“Fake” RAID cards with a GRAID error

Certain “fake” RAID cards, driver/software-based RAID adapters that are not true hardware RAID, may fail to mount properly with the following error:

Root mount waiting for: GRAID

Another symptom can be that “Intel RAID” messages are shown during the boot sequence, and typing ? at the mountroot prompt it only shows the drive itself and no partitions:

Mounting from ufs:/dev/ada0s1a failed with error 19
mountroot> ?
  • Escape to a loader prompt during bootup and run:

  • After a successful install/boot, add that settings permanently to /boot/loader.conf.local:"0"

Conflicting Hardware

If the system stops with an error such as:

run_interrupt_driven_hooks: still waiting after 60 seconds for xpt_action

Disable any Firewire/1394 controllers and built-in USB Card Readers in the BIOS.