pfSense Software Version 24.03 Sneak Peek
This latest update includes new features like an improved update process, the ability to export packet flow data, an enhanced gateway recovery process, and changes to the default state policy for increased security.
Enhanced Update Process using ZFS snapshots
pfSense Plus software version 24.03 will include major enhancements to the software update process, using features of the ZFS file system to increase stability and reduce downtime during an update. These enhancements will also offer powerful new tools to pfSense Plus admins who use system snapshots to create multiple pfSense Plus environments during testing and who value the ability to fall back into a known environment if necessary.
To learn more, check out this short video by Christian McDonald from the pfSense development team.
Read the blog here.
Packet Data Flow Export
Another new feature of pfSense Plus software version 24.03 is the ability to export packet flow data to one or more external collectors using either the NetFlow v5 or IPFIX protocol. Analyzing flow data can be critical for network management. Flow-based metrics can help with application response issues, usage-based accounting, traffic profiling, traffic engineering, attack/intrusion detection, QoS monitoring, and more.
Check out this video by Jim Pingle from the pfSense development team.
Read the blog here.
Gateway Recovery
The new release will also include an enhanced gateway recovery process, with options to reset connections made through a backup gateway while the primary gateway is offline. This feature will allow connection fail-back to a primary gateway after downtime, should the primary and secondary have unbalanced bandwidth (ex., primary has 10Gbps, and backup is 1Gbps).
Read the blog here.
State Policy Default Change
The default State Policy in pfSense Plus 24.03 software and later releases are changing from Floating states to Interface-bound states for increased security.
In nearly all configurations, pfSense software tracks connections using firewall states so it knows which return traffic to allow back through the firewall for connections that were passed in the other direction. These states carry quite a lot of information, such as the source address, destination address, protocol-specific data such as port numbers, translation information from NAT, metadata such as timestamps and packet counts, and more. For traffic passing through the firewall (e.g., LAN to WAN, LAN to VPN, LAN1 to LAN2), there are typically two state table entries: One as the connection enters the firewall (ingress) and one as the connection exits the firewall (egress).
The state policy fundamentally changes how the firewall checks packets against the interface data in state table entries to determine if a packet should be allowed.
Check out this video by Jim Pingle from the pfSense development team.
Read the blog here.
%201000px-1.png?upscale=true&width=600&upscale=true&name=Netgate%20Logo%20White%20(horizontal)%201000px-1.png)
