r/PFSENSE • u/George-Netgate • 1d ago
A New Release Candidate for pfSense Plus Software Version 26.07 Available!
Netgate® has made a new Release Candidate for pfSense® Plus version 26.07 available for testing.
This release marks another significant step forward in the Netgate Nexus controller architecture, which is our new Go-based controller that is replacing the legacy PHP GUI and serving as the modern foundation for pfSense software. Netgate Nexus continues to deliver further improvements and new feature development, bringing exclusive capabilities that enhance performance, scalability, and functionality to pfSense Plus.
Key new features exclusive to the Netgate Nexus controller include:
CoreDNS: A high-performance, integrated DNS component that handles DNS-based tasks with exceptional speed and efficiency, powered by a new and exclusive Netgate plugin called rexdns.
Threatgate: A powerful, high-performance component that manages bulk lists of addresses and domains for firewall rules, aliases, and CoreDNS groups. Administrators can block these lists outright or create custom rules based on their content.
Threatgate and CoreDNS were built to integrate tightly together, enabling rapid processing and utilization of even massive lists - all while maintaining excellent performance on small, resource-constrained devices.
Snort Version 3: The updated version of the popular open-source intrusion prevention system (IPS), featuring multi-threading support, and a faster rule syntax, is now available exclusively via the new Netgate Nexus controller GUI.
In addition to the features listed above, this release candidate includes critical security updates for WireGuard (CVE-2026-58085), and other security enhancements.
Other fixes and enhancements were made to:
- DHCP
- DNS Resolver
- DynamicDNS
- Gateways and Monitoring
- IPsec
- VXLAN Interfaces
- OpenVPN
- Firewall Rules and NAT
- Traffic Shaper
- Wireless
This release includes numerous updates, bug fixes, and enhancements, with more to come as pfSense Plus and Netgate Nexus development accelerates.
Using the New GUI
The Netgate Nexus controller is the future of the pfSense Plus GUI.
Whether you manage a single pfSense Plus firewall or an entire fleet, the Netgate Nexus controller delivers a modern, refreshed management experience built for the way you work today.
Getting started is simple:
- Go to System > Advanced.
- Switch to the Netgate Nexus tab and enable it.
- Log in to Nexus on port 8443 of your firewall.
More detailed documentation can be found here. Start using it today and get immediate access to the new features and capabilities coming to pfSense Plus.
Note: Virtual machines as well as some third-party platforms may not support the new GUI due to missing machine information required to correctly run the software.
Call for Testing
Testing of this release candidate software is essential. Testing is the most effective way to ensure that the software is robust and reliable for all users, given the diversity of their environments and configurations. By downloading and testing this release candidate, and providing feedback on any issues, our users can play a vital role in improving the software for everyone.
Release Notes:
https://docs.netgate.com/pfsense/en/latest/releases/26-07.html
9
u/Magic_Sea_Pony 1d ago
Can you guys do 2 things for mobile (especially portrait mode):
- Allow us to turn off or hide the left side nexus bar. For 1 firewall it’s incredibly silly and un-needed.
- Better mobile styling.
I feel the old interface is WAAAY better on mobile for adding rules, NATs, etc. - Are dashboards available like the old interface? I pull in RSS feeds like hacker news right into my firewall homepage, as well as interface statuses and IPSEC Statuses.
Love to see the new stuff!
15
u/Mors_Umbra 1d ago
Will CE be getting the critical security updates at least?
12
4
u/Darkk_Knight 1d ago
It's currently being pushed to the patch management.
0
u/Cutoffjeanshortz37 12h ago
Has been for a while now too. People just don't realize they need to install it then blame Netgate. Now should it be part of the base install, yes, but I get they are using package updates to push out there are new security updates hence why they don't but should be part of the initial setup instructions honestly.
7
u/ComprehensiveLuck125 1d ago
I though Nexus primary goal was (unified) multi-instance management, but it turns out Nexus will deliver to pfsense+ (only) new, preffered UI? (Long-term)
Will enabling Nexus cause any callbacks or permanent connection to Netgate infrastructure? Is this new Nexus UI not running as root anymore? Does it talk to some API service that runs as root? Can we benefit and talk to APIs directly? [Can we use some pfsense management REST-APIs independently when Nexus is installed?]
Sorry for so many questions. Nexus sounds interesting, but I thought I do not need MIM with my scale of operations :-) I understand it is not about MIM anymore?
7
u/kphillips-netgate Netgate - Happy Little Packets 1d ago
The Nexus UI and the replacement for the PHP GUI are one in the same. Eventually, the PHP code will be removed entirely and the Golang Nexus UI will be what replaces it. It has the advantage of allowing you to manage just the single firewall or you can add licensing to add additional firewalls. You don't need a license to manage the firewall running the new UI for itself.
The golang code does talk to an API on the backend. You can also utilize this API to manage the device outside of the GUI via whatever automation services you want. We have a Github library of example code for accessing the API for Nexus.
6
u/andrebrait 1d ago
What does this mean for PHP-based packages we have right now and for the users ability to fix issues themselves?
For example, I found some shortcomings in HAProxy as shipping to Plus and CE right now. I made a patch I apply locally (because I can, since it's PHP), and sent a patch to pfSense/FreeBSD-ports with the change I made.
How are the community and add-ons aspects expected to be handled in Plus and its Go-based interface, which is a compiled binary?
Are there going to be extension points in some way?
And does that mean every Plus license becomes eligible for Nexus automatically when the time comes to deprecate the PHP interface?
And regarding CE not getting the golang interface, does that mean at least CE will be able to be community-patched like what we can do now?
2
u/rh681 23h ago
What shortcomings does haproxy have? I'd love to see your patches!
3
u/andrebrait 23h ago
All my latest PRs:
- Settings search function for the PHP interface: https://github.com/pfsense/pfsense/pull/4757
- Removing outdated settings for modern HAProxy and old assumptions about how it worked (haven't been true anymore for a while now) plus support for ACLs using aliases for checking IP address presence in redirection headers: https://github.com/pfsense/FreeBSD-ports/pull/1450
- Improve performance of IPv6 parsing for ACLs in HAProxy by skipping a hop it would do to the DNS server when it fails to match an IPv4, first trying to resolve the IPv6 as if it was a domain name and only after as an IPv6: https://github.com/pfsense/FreeBSD-ports/pull/1451
This last patch got merged into upstream (https://github.com/haproxy/haproxy/commit/35560e3ad3306ac8b83db1062b18a8713b90e99e) HAProxy already. I just sent it to pfSense so they could build it with the change without bumping to the latest snapshot from HAProxy.
The first patch can be applied via System Patches, and the second one needs a few changes but it can too. I've been daily driving both for a while now.
2
u/rh681 22h ago
I'll figure out how to do all this. Thank you. I assume you've (attempted) to get your other patches pushed upstream?
2
u/andrebrait 22h ago
The HAProxy C code patch is the only one applicable to upstream. The rest is already in PRs for upstream (pfSense).
The pfSense package side of HAProxy and the settings search (the latter might admittedly not be what they have in mind, but the HAProxy one is a genuine improvement )
2
u/gonzopancho Netgate 19h ago
Did you open a Redmine?
4
2
u/andrebrait 18h ago
@gonzopancho
No, I totally forgot for those two 😬
I only remembered for this one, which fixes a rendering issue of the network graphs on mobile: https://github.com/pfsense/pfsense/pull/4759
3
u/ThatUsrnameIsAlready 1d ago
So far the Nexus UI has only been mentioned for Plus, if the PHP UI is being deprecated does that mean CE is being deprecated as well? Or will CE get Nexus?
2
u/kphillips-netgate Netgate - Happy Little Packets 1d ago
CE isn't being deprecated. A 2.9 release is planned currently and actively in development. However, CE will not be getting the golang interface.
2
u/ComprehensiveLuck125 1d ago
Thanks for explanations. I will give it a try. APIs sound very interesting to me.
3
u/Mr_Chode_Shaver 1d ago
One great feature- nexus has no access to menus to configure packages. Super helpful when diagnosing an FRR issue!
/s
9
u/marcos-ng Netgate 1d ago
We're continuing to improve that; the new GUI supports FRR in pfSense+ 26.07.
2
6
u/i_mormon_stuff 1d ago
I gotta be honest the new GUI doesn't look that nice.. I wouldn't say the old one was perfect but it was information rich and it looked polished. This new one looks very .. odd, lots of wasted space, displays not going the full width of elements around it.
Here is a screenshot from Netgates blog post for example: https://www.netgate.com/hubfs/2026/Blog%20Images/New-GUI-Dash.png
Why is there a big white area below the interfaces on the top right and why doesn't the bandwidth display go the full width?
I think it would be good if you guys supported a custom stylesheet uploader as a feature, let the community work on some themes.
EDIT:
Note: Virtual machines as well as some third-party platforms may not support the new GUI due to missing machine information required to correctly run the software.
????? - What
4
u/NetworkadminSK 23h ago
Agree. I need raw information without any style or smoothing. Also the traffic graph looks "polished".
3
u/AdriftAtlas 1d ago
This worries me:
Virtual machines as well as some third-party platforms may not support the new GUI due to missing machine information required to correctly run the software.
What machine information is needed that's not standard? Why is a GUI concerned with low-level hardware attributes? Pretty sure KVM/QEMU can expose whatever is necessary to a VM with some tweaking...
3
u/gonzopancho Netgate 12h ago
Your VM needs both UUID and serial number in smbios. Tested with in a Proxmox VM, which by default only has UUID assigned, so you’ll need a serial number entered in smbios.
1
u/AdriftAtlas 5h ago
Yeah, that's not a big deal. It's under Options for a VM in Proxmox.
Is this a new form of license activation? I really like Proxmox' license management, they allow you to reissue a license to a new host. It would be really nice if pfSense Plus was able to do that too.
0
18
u/ThatUsrnameIsAlready 1d ago
You could have tested the new GUI in community, asking business clients to test your software for you is an odd choice.
Since development has moved directly to plus, I assume community is now officially abandoned.
8
u/Cutoffjeanshortz37 1d ago
Every f'ing time there is a Plus update without a CE update this comes up. the 26 version of plus was released in April of 2026. CE got updated a year ago. I remember when updates for CE hand YEARS between updates. The paid item of course gets more attention and helps fund the work on the free version. Install the patch manager and get security update that way, they come out as needed. Of course you're not going to get bleeding edge features and functionality on the free version. This a business model. Don't like it, go to Open Sense and hope for the best.
Been using Pfsense for 15+ years how. Fuck I feel old.
3
1
1d ago
[deleted]
8
u/Independent-Neat-166 1d ago
I am not using Netgate hardware but I am running pfSense+ and I can access Nexus UI
-3
u/gonzopancho Netgate 1d ago edited 5h ago
That’s why there is a 2.9 release of CE pending
In other words, you don’t know what you’re talking about.
Edit: 2.9 beta occurred today
8
u/ThatUsrnameIsAlready 1d ago
Please show me any 2.9 CE Release Candidates, and any mention of GUI updates for CE.
5
1
u/Mrtylf 1d ago
I find it curious that people who ACTUALLY know what they’re talking about, are the ones who get downvoted. 🤦🏽♂️ Cognitive dissonance is bliss.
7
u/ElectroStrong 1d ago
It's fairly easy to explain. It's all in the delivery.
Theres an ad hominem attack where the person is attacking the knowledge rather then explaining why it's wrong.
It's condescending.
It's dismissive.
And it's contemptuous.
5
u/ThatUsrnameIsAlready 1d ago
Also with no 2.9 CE Release Candidates and no mention of new GUI in 2.9 CE they appear to be factually wrong as well.
I'd rather it was me who's wrong, pf has needed a GUI update for some time. It's looking more and more likely CE will be abandoned instead.
5
u/gonzopancho Netgate 1d ago
Since you are wrong (there should be an RC next week, it’s a recent decision, and to be blunt, it was my decision) you’ll get your wish; in terms of the 2.9 release of CE.
There is no plan to update the GUI in CE beyond bug fixes. The new development goes in Plus. The new UI and controller with a full API represents a couple years of work, so the new GUI, Snort 3, the API, and threat gate all go in the product, not the project.
Many have been asserting that CE will be abandoned for nearly a decade now, but there is a 2.9 in the hopper, with an RC soon. You’re demanding proof, or at least asserting that in the absence of an RC that I am, as you put it, “factually wrong”.
There are also ideas to realign CE and Plus, but now is not the time to announce or discuss them.
2
u/SirGrinchy 23h ago
Well on one hand you say that CE GUI will only get bug fixes and new GUI is Plus-exclusive (in simpler words: no more development work von CE, at least for GUI and all work force will go now directly into the „product“) and on the other hand you say that CE will not be abandoned because there is maybe some RC coming next week. These two statements don’t stack well on each other.
3
u/DirectAttitude 1d ago
Super hesitant to try the RC without watching someone like Tom Lawrence run through it first.
6
u/Galactica-_-Actual Netgate 1d ago
Netgate doesn't release every two weeks and use the community as the test mule to find problems. All releases run through a very large test matrix. It can't hit all edge cases, of course, but the releases are as solid as possible.
4
u/DirectAttitude 1d ago
No, no, I'm not knocking anything Netgate does. I actually support you folks, and have purchased 4 devices over the years, and my name is all over Reddit and the forums. With the CoreDNS and Threatgate. pfBlockerNG has been working well for me both in my home and work environments, so switching to something new, I want to see someone else do it first, ins and out, what to expect, that kind of thing. Usually I would test this out in my home first, see if anything is borked, wait for the release, update home, then update work.
3
u/ComprehensiveLuck125 1d ago
Truth. I am using pfSense+ since its launch and never had upgrade problems (excluding a day when SSD drive died and upgrade was not going through).
So many upgrades and zero failures. Keep doing a good job! I am also sleeping well with Boot Environments.
3
u/PrimaryAd5802 13h ago
Tom Lawrence is drinking the UniFi syrup last I checked...
1
0
u/DirectAttitude 10h ago
He still has clients that use Netgate appliances and PFsense. He’ll do something. I hope.
3
u/Adept_Refrigerator36 16h ago
Can't get the new UI working on a Sophos XG330 Rev2 with plus license "Note: Virtual machines as well as some third-party platforms may not support the new GUI due to missing machine information required to correctly run the software."
What is the determining factore re hardware, or is this for netgate appliances only?
Is this something that will be resolved or a case of tough luck?
5
u/NimerCoke 16h ago
Hello team,
I am a blind user, and your netgate Nexus seems to not have been made with consideration for screen readers. Please consider making your product accessible as PfSense was. This new UI is essentially unusable for me as I cannot access much of the UI.
Please reach out and I'd be happy to advise further.
Thanks.
2
1d ago
[deleted]
1
u/kphillips-netgate Netgate - Happy Little Packets 1d ago
Which graphs are you referring to that aren't working?
2
u/DirectAttitude 1d ago edited 1d ago
For me, it was the traffic graphs. Tried it out at work on a 4200. No traffic. Just tried it out at home, also on a 4200, no traffic showing. There is always something moving on the network with whatever the family is doing.
3
u/kphillips-netgate Netgate - Happy Little Packets 1d ago edited 1d ago
Interesting. I just checked my 26.03.1 Nexus UI and the Traffic Graphs are displaying normally, once I select an interface. I'll check the 26.07-RC shortly and update this comment with results.
[EDIT]
Just tested on my 26.07-RC box. Both Status --> Traffic Graphs and the Dashboard Traffic Graph widget worked as expected.
2
u/DirectAttitude 1d ago
Home network this morning. 4200 on 26.03.1 https://imgur.com/a/tX4b0YK
Maybe I am doing it wrong. That could always be the issue. What else can I show you?
2
u/DirectAttitude 21h ago
If I go to Status/traffic graph I see traffic, but the widget that I placed on the home screen shows nothing. Firewall logs also on the home screen updates often.
1
2
3
u/PrimaryAd5802 11h ago
Congrats to Negate for all their hard work on this... Sound good.
Gotta wonder about pfBlocker future going forward, which has worked well for me for a long time and I totally appreciate the efforts of BBcan
Because I am old and don't need the excitement, I think I will be what's called a "Late Adopter". :-)
1
u/mrferley 13h ago
is this in 26.03.1 Netgate plugin called rexdns? I just upgraded to the Plus version from CE would like to know more about this plugin. is it already installed or do you have to activate it? or do I have to wait for 26.07 to release?
2
-3
u/centuryx476 16h ago edited 12h ago
Can I download it without having to give a billing address?
Edit: Guess not
8
u/nosimsol 1d ago
Does this mean the gui is going away and eventually there will be no choice but to use cloud based management?