pfSense Digest

Haven’t had a post up here in a while, but for anyone who watches our git repository, you know development never ceases. Vast amounts of work have gone into 2.0 this year, and it really shows. We’re deploying it in production, though generally recommend you don’t yet.

A work in progress list of 2.0 new features and changes is available. I think that has most of the changes, but it’s definitely missing some. If you notice anything that was missed, please leave a comment. We’ll be adding to it as we review the list more in the coming days.

It’ll be released sometime this year.

Our Christmas gift to the community is our 2.0 release reaching the beta milestone.

What does this mean? The release is feature complete, with no new features being added, and should stay relatively stable throughout the remainder of the development process. That’s not to say it’s production ready though, most of our developers are using it in production and have been for months, but unless you have a solid understanding of the underlying system and can manually verify the configuration, 2.0 is not yet for you.

To answer the inevitable “when will it be released?” – as always, “when it’s ready”. The release will happen sometime in 2010, but as for a more specific timeline, we can’t provide one at this time.

If you have a non-critical environment where you can try it out, you can find the latest build on the snapshot server (mirror also available here). Please report your experiences on the 2.0 board on the forum. There is additional risk with snapshots as changes are made in the source very frequently, and you may get a snapshot from a point in time that caught part but not all of certain changes.

Known Issues

The most current list of known issues can be found here. Those marked as “Feedback” are either believed to be resolved but need more testing, or need further details to be able to replicate and resolve – feel free to add comments to any of those tickets if you can test the specific scenario described. Those marked as “New” are outstanding issues. We welcome contributions, if you can provide a fix for any of the open issues. Before opening a new ticket there, please post to the 2.0 board on the forum where we can help quantify the issue. Before reporting problems, ensure you’re on the latest snapshot. At least 10-20+ changes go in most every day, 7 days a week, so it’s very possible the issue you found is already fixed in our git repository. You can see all commits here.

Important upgrade warning

You can upgrade from 1.2.x to 2.0 just as with any other release, BUT, you cannot downgrade from 2.0 to 1.2.x. And after you upgrade, your configuration will be converted to a format that is usable only on 2.0. If you do upgrade, get a backup first so you can reinstall 1.2.3 if needed. Several of the features in 2.0 were revamped to the extent that a change in configuration formatting was necessitated. Many of the rough edges of 2.0 are in the configuration upgrade code, there is less risk with a clean 2.0 install than one upgraded from 1.2.x at this time. Though that’s largely in more advanced configurations.

Proceed with caution! Expect things to be broken, this is absolutely not production-ready for most scenarios for non-developers, but development is moving along rapidly, and we would appreciate feedback from those in a position to test things (and break their network).

Note that kernel debugging is still enabled, which will reduce performance, though from a packet forwarding perspective it’s usually not noticeable.

Merry Christmas from the pfSense team!

The pfSense team will come together again this year for a week of development in the 2nd week of March in Louisville. The time will be mainly spent on working on pfSense 2.0. You should expect some huge progress on various features and the overall status of this major release. It looks like this year even more developers will make it to this convention (besides the usual suspects that have always been around).

If you want to show your support to the project now is the time to do so by sending a donation to fund the expenses of this years hackathon (mainly food and drinks or even travel expenses if enough money comes together). For details on how to donate check out this site. You can chip in via PayPal here, or for those with larger budgets, consider our commercial support services. 

We also want to thank all the past donors that helped fund this event the last three years. It’s always been a great success, and we look forward to another week of significant progress for the project. 

Thank you!

As 2008 comes to a close, we have many plans for 2009. This post outlines some of the big things coming up in 2009.

• CVS conversion to git – this has been partially in progress for 6 months now, and now that 1.2.1 is out, Bill Marquette is working on getting us converted. This should be done within the next week, and brings a number of development-related benefits which will be detailed later.
• pfSense as an appliance building framework – one of the things Scott and I envisioned in founding this project is to make it into an appliance building framework, in combination with the package system. With 2.0, this has come to fruition. The firewall project will remain as it is today, but we have also set things up in a way that allows us to build appliances such as pfDNS, pfPBX, and more to come. This also makes it easier to build the rebranded versions of pfSense that several companies sell. If your company is interested in selling a rebranded version, we encourage you to check out our reseller subscription.
• Release of pfSense: The Definitive Guide book – this has been a work in progress for more than a year, and should be in print and available for purchase in the first quarter of 2009.
• Conferences – pfSense will be presented at multiple conferences this year. DCBSDCon in February is confirmed, and we will likely also be at BSDCan and NYCBSDCon in 2009.
• Developer summit/hackathon – we’ll be having our fourth annual developer conference in March. This is a full week get together, with 6-8 developers expected to attend from across the US and Europe.
• 1.2.x maintenance releases – We will put out maintenance releases with bug and security fixes as needed, probably into 2010. None will see as significant of changes as 1.2 to 1.2.1, with the switch from FreeBSD 6.2 to 7.0, to avoid the lengthy release engineering process that significant change necessitated.
• 2.0 release – we hope to see the 2.0 final release late in 2009, or at a minimum, be at release candidate status by this time next year. There is a significant amount up in the air with this release, and a lot of work remaining to be completed, so this is a very rough estimate. After getting converted to git, we will be moving 2.0 from its current FreeBSD 7.1 base to what will become FreeBSD 8.0. We expect the 2.0 final release will be on FreeBSD 8.0, though that depends on FreeBSD’s release schedule which is entirely outside our control.

2008 was the most successful year to date for this project, and we look forward to making 2009 top that. Thanks to all of you who support the project, especially our commercial support and reseller subscribers!

Here’s to a great 2009. Happy New Year!

The pfSense version formerly known as 1.3 will be 2.0 going forward. The build system changes, renaming of the board on the forum, etc. will be happening bit by bit over the next week or two. This was done for two reasons.

1. This release brings numerous very significant changes, and going from 1.2 to 2.0 is more indicative of that. The configuration for 2.0 systems is not backwards compatible with 1.2.x, which is another good reason to stress the level of change by bumping the version number.

2. The person who wrote the package system’s version compatibility detection didn’t exactly use much foresight (not naming names, is no longer an active developer). Every existing version of pfSense only checks the first number in a version to see if it’s compatible, so a package marked for 1.3 only will show up on any version that starts with 1. Because, you know, who would ever release a 1.0, 1.2, 1.3, etc.?  It’s something that had not previously been a problem because packages weren’t as version-dependent as some are now. Changing the version to 2.0 is the easiest way to work around this and still accommodate all the existing installations out there, and it just makes sense to do so as noted above.

Lastly, the answer to the inevitable “When will it be released?”.