Software Update: OPNsense 21.7.3

The package OPNsense is a firewall with extensive possibilities. It is based on the FreeBSD operating system and is originally a fork of m0n0wall and pfSense. The package can be set up completely via a web interface and has support for 2fa, openvpn, ipsec, carp and captive portal, among others. In addition, it can apply packet filtering and has a traffic shaper. The developers have released OPNsense 21.7.3 with the following announcement:

OPNsense 21.7.3 released

This release finally brings in Suricata version 6 as well as OpenVPN tls-crypt support, automatic user creation on LDAP-based logins and more. As a general note the Realtek vendor driver currently bundled with the base system will be moved to a plugin-based kernel module in version 22.1 and the original re(4) driver inside FreeBSD 13 will be restored. To ease migration and because the version maintained in FreeBSD ports actually offers additional fixes we have inlcuded the new plugin into this build.

Here are the full patch notes:

• system: allow automatic user creation on LDAP-based logins
• interfaces: add and use unified function is_interface_assigned() to prevent deleting assigned interfaces
• interfaces: sync firewall groups after internal create/destroy operations
• interfaces: add netstat tree search and improve page layout
• interfaces: replace opportunistic diagnostics IP address lookups with more robust variants
• firewall: clarify match/set priority in rules
• firewall: improve alias description/preview
• firewall: aliases maximum entries progress bar
• dhcp: add shared dhcpd_leases() reader and use it in both lease pages
• openvpn: use is_interface_assigned() to prevent deletion of assigned instances
• openvpn: CARP status read cleanups (contributed by vnxme)
• openvpn: tls-crypt support (contributed by vnxme)
• openvpn: do not create empty router file
• router advertisements: remove AdvRDNSSLifetime / AdvDNSSLLifetime bounds (contributed by Maurice Walker)
• unbound: register DHCP leases with their matching IP range configured DHCP domain
• plugins: os-acme-client 3.1
• plugins: os-chrony 1.4
• plugins: os-collectd 1.4
• plugins: os-fetchmail 1.1
• plugins: os-freeradius 1.9.16
• plugins: os-realtek-re 1.0 adds Realtek vendor NIC driver module
• plugins: os-telegraf 1.12.1
• ports: dnsmasq 2.86
• ports: filterlog 0.5 removes unused IPv6 options support
• ports: nss 3.70
• ports: pcre 8.45
• ports:python 3.8.12
• ports: sudo 1.9.8p1
• ports: suricata 6.0.3
• ports: syslog-ng 3.34.1