What is up everyone,

Summer challenges aside: 26.7 is almost here! It includes FreeBSD 15.1 and a somewhat small list of other highlights. The reason for that is a stringent backporting strategy that was employed in the 26.1 series.

Keep in mind this is mostly an image-based pre-production test release. Upgrades from the 26.1.11 development version will be available later this week. An online-only RC2 will probably follow as well. The final release date for 26.7 is July 15.

Here are the development highlights since version 26.1 came out:

Interfaces assignments to MVC/API
Gateway groups to MVC/API
Firewall rules MVC page is now the default
Source NAT is now a replacement for outbound NAT
Captive portal IPv6 support
Kea DDNS, custom options and dynamic prefix delegation support
OpenVPN 2.7 with TLS-Crypt v2 support
FreeBSD 15.1
Python 3.13
PHP 8.5

And these are the changes against version 26.1.11:

system: remove periodic backups settings and backend code
system: migrate gateway groups to MVC/API
system: new service widget flat tile layout (partially contributed by Konstantinos Spartalis)
system: make LDAP auth adhere to bad login penalty as well (contributed by Matt Andreko)
system: move ldap_escape() to caller for now to avoid side effects
system: improve the log_archive script to also work on log subdirectories
system: change our version of "certctl" to emit files instead of links like it is the case in FreeBSD 15.1
reporting: migrate several settings pages to MVC/API and assorted changes
interfaces: migrate interface assignments to MVC/API
firewall: move config.xml default LAN allow rules to new rules GUI
firewall: legacy rules pages move to plugin
firewall: restrict automatic DHCPv6 filter rules to plugin/track6 use
firewall: always set a sequence at the end of the rule set when cloning a NAT rule
firewall: remove unused "safepoint" actions
firewall: fix automatic source NAT rules not displayed for PPPoE interfaces
firewall: flatten automatic source NAT rules into two per WAN type interface
firewall: prevent deletion if a group is referenced in MVC rules
captive portal: move template actions out of the ServiceController into its own TemplateController
dnsmasq: possible use before define in lease watcher
intrusion detection: rename "uncategorized" rule package to "adult" (contributed by Konstantinos Spartalis)
unbound: missing NetMaskAllowed=N on override address
wireguard: add allowed-ips to reresolve-dns.py in case none are set yet
acl: merge user management ACLs into one single privilege
backend: allow "strict" mode +TARGETS using the preamble "!"
mvc: refactor base_dialog and parseFormNode() to simplify the template
mvc: remove unused argument from getFormGrid()
mvc: BaseField: emit descriptions in getNodes() when they are not the same as the value to match getNodeContent()
mvc: PortField: reject whitespaces in port ranges during validation
mvc: ModelRelationField: remove grouped option handling
ui: add "opnsense-auto" theme which switches between "opnsense" and "opnsense-dark" depending on browser setting
ui: decrease flashing in opnsense-auto theme when switching (contributed by Konstantinos Spartalis)
ui: remove direct apply_btn_id usage in favour of base_apply_button template partial
ui: fix menu registration not setting "active"
plugins: os-firewall-legacy 1.0 contains the static PHP firewall rules pages
plugins: os-ndproxy has been removed, use os-ndp-proxy-go instead
src: FreeBSD 15.1-RELEASE-p1 plus assorted stable/15 networking commits[1]
ports: libevent 2.1.13[2]
ports: openvpn 2.7.5[3]
ports: sqlite 3.53.3[4]

Migration notes, known issues and limitations:

The privileges "page-system-groupmanager" and "page-system-usermanager-addprivs" were merged into "page-system-groupmanager" and are no longer available separately. This was done to avoid the misconception that access to a user management page gives constrained rights to each page, but that is not the case. User management is a process involving all 3 pages.
The static PHP pages for firewall rule management have been moved to the "os-firewall-legacy" plugin that can be optionally installed. Note that the upgrade will not install it as rules will continue to work and are easily migrated using the given assistant.

The public key for the 26.7 series is:

Please let us know about your experience!

Stay safe,
Your OPNsense team

SHA256 (OPNsense-26.7.r1-dvd-amd64.iso.bz2) = 6b8430921316bd1d912a7bf71d02f2e354cd82b644c3fbf2646ab55382b9a758
SHA256 (OPNsense-26.7.r1-nano-amd64.img.bz2) = 1b95ab4cafaa195272b2b9d7ac3f42015c277b918818f535851c8c3206c5829d
SHA256 (OPNsense-26.7.r1-serial-amd64.img.bz2) = 0db5557508f088e513436f6f7ad5c37f42c6614ce50a34595523890cded7c336
SHA256 (OPNsense-26.7.r1-vga-amd64.img.bz2) = 2e352fd8628e742dd0637a8f84768f607b3ad45a4491a77d9623b4976ac6931b