pfSense and OPNsense firewalls: staying updated

Updated November 2026

pfSense and OPNsense are firewall systems built on FreeBSD. Both update from the web GUI in a few clicks, but only the newest releases get security fixes. Take a configuration backup, install the update, let the firewall reboot, and never make the web GUI reachable from the internet.

Supported versions

Neither project publishes fixed end-of-life dates. Netgate marks each pfSense version as "current supported" or "previous unsupported", and its support team (TAC) only helps with the most recent stable releases. OPNsense's advice is always to upgrade to the latest community or business version.

Supported versions (as of November 2026)
Product	Supported	Released	Next
pfSense Plus	26.07, 26.03.1	August 13, 2026; May 27, 2026	26.10 (date not set)
pfSense CE	2.9.0, 2.8.1	August 20, 2026; September 4, 2025	Not announced
OPNsense Community	26.7 series (26.7.8)	July 15, 2026 (26.7.8: October 30, 2026)	27.1, planned for January 2027

OPNsense ships two major releases a year (January and July, numbered 26.1, 26.7) and a minor update about every two weeks (26.7.1, 26.7.2...). The last 26.1 update was 26.1.11 on July 1, 2026; since 26.7 came out, new fixes have shipped as 26.7.x updates. A separate paid Business Edition follows its own April/October schedule (26.4, 26.10). pfSense Plus versions use year and month (26.07); CE uses classic numbers (2.9.0). An upgrade always stays on the same edition: CE upgrades to the newest CE, Plus to the newest Plus.

Back up before every upgrade

pfSense: go to Diagnostics > Backup & Restore, set Backup area to All and click Download. Keep copies in more than one safe place. Netgate also offers a free Auto Config Backup service, which stores encrypted copies on its servers. On pfSense Plus installed on ZFS, the upgrade creates a boot environment you can boot back into; check System > Boot Environments first and delete old ones, because a major upgrade can need 1.5 to 2 GB of free space.

OPNsense: go to System > Configuration > Backups and download the configuration, protected with a strong password because it holds sensitive data. On a ZFS install, create a snapshot named known-good under System > Snapshots. If the upgrade fails, activate it in the GUI, or at the boot menu press 8 (Boot Environments) and select it.

On a virtual machine, take a VM snapshot as well. Netgate also recommends a reboot before the upgrade, so that a failing disk shows up before the upgrade rather than looking like an upgrade bug.

Update pfSense

In the web GUI

Go to System > Update (or click the update icon in the System Information widget on the dashboard).
Check that Branch is set to Latest stable version.
Click Confirm. The firewall downloads the update, installs it and reboots automatically.

From the console or SSH

At the console menu choose option 13 (Update from console). Or, from a shell as root:

pfSense-upgrade

This reboots the firewall when it finishes. Over an unreliable SSH link, run it inside screen so a dropped connection does not interrupt it:

pkg install screen
rehash
screen pfSense-upgrade

Watch the console during the upgrade if you can. The firewall needs internet access to update.

Packages and patches

Netgate's safest advice for a new release is to note your packages, remove them, upgrade, and reinstall them. Never upgrade packages ahead of the base system while the firewall points at a newer release's repository, and never add third-party package repositories: they can leave the firewall unbootable.

Between releases, Netgate publishes recommended patches, often security fixes, through the System Patches package. It is installed by default on Plus 26.03 and later and CE 2.9.0 and later. Open System > Patches, look at the Recommended Patches list and apply the entries that fit your version. Click Enable Auto-Apply to have them applied at each boot and after updates (this is off until you turn it on). New recommended patches arrive with updates to the System Patches package itself.

Read the release notes. CE 2.9.0 removed old SSH algorithms and rejects weak TLS certificates, and some hardware, including certain Celeron J devices, needs a loader setting before upgrading. These notes save you from a firewall that does not come back.

Update OPNsense

Minor updates (every two weeks)

Go to System > Firmware > Status and click Check for updates.
Read the changelog, then click the button to install. Updates that replace the kernel or base system reboot the firewall.

Under System > Firmware > Settings, keep Release Type on Production; Development gives you untested code. From the console, option 12 runs the same update.

Major upgrades (twice a year)

Major upgrades install offline: the web GUI and SSH are down while they run. OPNsense recommends doing them at a VGA or serial console. On the latest minor release, choose option 12 at the console, type the new major version (for example 27.1) and press Enter. The firewall downloads everything, reboots, installs, and reboots again. Have your snapshot or backup ready.

Check for known flaws

On System > Firmware > Status, click Run an audit and choose Security. It compares installed packages with the FreeBSD vulnerability database (VuXML). A finding usually means the next update fixes it, so install updates rather than reporting it.

Never expose the web GUI on WAN

Most pfSense security advisories published in 2026 are for the web GUI (named pfSense-SA-26_xx.webgui), and recent OPNsense updates also fixed several GUI flaws. A login page open to the internet turns each of those into a remote attack. pfSense allows GUI access from LAN and denies it from outside by default, and OPNsense's documentation says the management interface should be reachable only from trusted networks. Keep it that way:

Manage remotely over a VPN (WireGuard, OpenVPN or IPsec) and use the firewall's LAN address.
Do not add a WAN rule that allows the GUI port. If you truly must, allow only fixed source addresses and use HTTPS.
Give admin accounts only to people who need them, with unique passwords and two-factor login (MFA) where available.
Restrict SSH the same way, or turn it off when not in use.

See Firewall basics for firewall basics.

Where advisories are published

pfSense: the Netgate security advisories list, and the Netgate security page, which offers a subscription to pfSense security announcements and takes reports at security@netgate.com.
OPNsense: published GitHub security advisories, which OPNsense calls its main channel for security issues, and the release notes, which list the FreeBSD advisories applied. Reports go to security@opnsense.org.
FreeBSD: both products build on FreeBSD, so its security advisories show what is coming.

On an unsupported version

Upgrade one step at a time and read each version's notes. Netgate warns that big jumps (for example from 2.3.x) should be tested on identical hardware first. If an upgrade fails, reinstall the current release and restore your configuration backup; both products upgrade old configuration files automatically. Replace hardware that is too weak for current releases: pfSense Plus no longer runs on AWS ".nano" or Azure A0 instances, for example.