2.4.4-p1 New Features and Changes¶

pfSense® software version 2.4.4-p1 corrects issues found with 2.4.4-RELEASE.

Security / Errata¶

FreeBSD Errata Notice FreeBSD-EN-18:09.ip: IP fragment remediation causes IPv6 fragment reassembly failure #8934
FreeBSD Errata Notice FreeBSD-EN-18:10.syscall NULL pointer dereference in freebsd4_getfsstat system call (CVE-2018-17154)
FreeBSD Errata Notice FreeBSD-EN-18:11.listen Denial of service in listen syscall over IPv6 socket (CVE-2018-6925)
FreeBSD Errata Notice FreeBSD-EN-18:12.mem Small kernel memory disclosures in two system calls (CVE-2018-17155)
Fixed a potential authenticated command injection issue with PowerD settings pfSense-SA-18_09.webgui #9061
Fixed handling of privileges on the All group that were previously ignored #9051

Warning

Check the privileges on the All group before upgrading to avoid unintended privileges for accounts being respected that were not honored before

Certificates¶

Fixed CRL lifetime errors due to 2038 rollover on 32-bit ARM platforms #9098
Fixed date display of CA/Certificate validity ending dates after 2038 rollover on 32-bit ARM platforms #9100
Fixed PHP errors when creating certificate entries #9099

DNS¶

Updated Unbound to 1.8.1 to address issues with memory leaks, especially in DNS over TLS support #9059
Fixed issues with the DNS search domain for the firewall being omitted from resolv.conf in certain cases #9056
Fixed PHP errors in the DNS Forwarder #8967

Dynamic DNS¶

Fixed an issue with FreeDNS Dynamic DNS sending an IP address with an update #8924
Fixed issues with Custom (v6) Dynamic DNS logging a hostname error #8977

DHCP Server¶

Fixed issues with DHCPv6 network boot settings #8949

Routing/Gateways¶

Reduced the logging output of gateway change events #8914
Fixed an issue with dpinger PID files causing it to get stuck in Pending status #8921
Fixed display of a configured gateway monitor IP address when gateway monitoring is disabled #8953
Fixed issues with double quotes in gateway descriptions causing a blank gateway drop-down on firewall rules #8962
Fixed an issue where the default gateway was lost in certain cases with HA after a CARP VIP status transition #8465

IPsec¶

Updated strongSwan to 5.7.1 #8898
Added 0.0.0.0/0 to both sides of an IPsec VTI P2 to allow connections with third-party routed IPsec implementations that require its presence #8859
Fixed boot-time handling of IPsec VTI static routes #9116
Fixed IKEv2 EAP Identity/Client ID matching so that it is strictly performed, to avoid users getting incorrect per-user settings #9055
Fixed handling of RADIUS server names containing a . in the IPsec configuration with strongSwan 5.7.1 #9106
Updated AWS IPsec wizard to use EC2 instance profiles and security groups, and switched the wizard from OpenBGPD to FRR

Interfaces/VIPs¶

Fixed issues with DHCP client MTU causing interface configure loops when advanced options are present #8507
Fixed issues with the Hyper-V hn(4) driver and ALTQ #8954
Fixed issues with Hyper-V hn(4) interfaces dropping UDP6 traffic when transmit checksums were enabled #9019
Fixed an issue with IGMP proxy failing to start on PPPoE interfaces #8935
Fixed an issue with IPv6 Transmit checksums not being disabled when hardware checksums were set to be disabled #8980
Updated mpd to 5.8_8 to address issues with Orange MTU #8995
Fixed PPPoE service name checks to allow : and other alphanumeric characters #9002
Fixed PHP errors when creating QinQ entries #9109
Fixed the MAC address shown when editing a LAGG entry to always show the hardware MAC for each NIC and not the currently active address, which is no longer accurate for LAGG members #8937
Fixed a PHP error when setting an interface address to act as a DHCP server from the console, when no other DHCP servers are already configured #9144
Fixed a situation where editing a VLAN interface caused all other VLAN interfaces with the same parent to be reconfigured, which led to several other issues #9115
Warning

Editing a VLAN parent interface can still cause problems. If this becomes an issue on a firewall, consider moving from using the untagged parent to having that traffic be tagged so that the parent interface is not assigned or in use. #9154

Known issues include:
- PPPoE instances on VLANs will not reconnect after the interface is reconfigured #9148
- VLAN interfaces that use IPv6 tracking may lose their addresses #9136

Hardware/Platform¶

Fixed handling of EFI console when a device boots from UEFI, where vidconsole is not valid #8978
Fixed PHP errors in switch configuration on platforms including integrated switches
Added support for SG-5100 hardware watchdog

Note

Enable the Watchdog daemon under System > Advanced on the Miscellaneous tab, and then reboot and enable it in the BIOS with a timeout longer than the timeout configured in the GUI.

User Management / Authentication¶

Fixed handling of privileges on the All group that were previously ignored #9051

Warning

Check the privileges on the All group before upgrading to avoid unintended privileges for accounts being respected that were not honored before
Added GUI options to control sshguard sensitivity and whitelisting to allow users to fine-tune the behavior of the brute force login protection #8864
Added an option to enable SSH agent forwarding (disabled by default) #8590
Fixed inconsistencies with ssh settings in the configuration #8974
Fixed PHP errors with ssh settings #8606
Added support for LDAP client certificates on authentication servers (Factory only) #9007
Fixed an issue with Local Database authentication when using non-English languages in certain cases, such as with Captive Portal #9086

Captive Portal¶

Fixed Captive Portal RADIUS NAS Identifier default values to include the zone name #8998
Restored the ability to set a custom NAS Identifier on Captive Portal RADIUS settings #8998
Fixed issues with Captive Portal logout popup #9010
Fixed handling of the login page displayed when RADIUS MAC Authentication fails #9032
Fixed username sent in RADIUS accounting with MAC-based authentication #9131
Fixed an issue with the blocked MAC address redirect URL #9114

WebGUI / Dashboard¶

Fixed nginx restart handling when toggling GUI web server options under System > Advanced, Admin Access tab
Fixed empty crash reports after upgrade #8915
Added CDATA protection to common name fields so they can safely contain international characters #9006

Firewall Rules / Aliases / NAT¶

The filterdns daemon has been rewritten, solving a number of issues with the old implementation, including:
- Fixes filterdns triggering every 16 seconds even when DNS records have not changed #7143
- Fixes invalid FQDN entries in aliases causing an alias table to fail silently #8001
- Fixes filterdns failing on a regular basis #8758
Fixed /etc/rc.kill_states not correctly parsing pfctl output #8554
Fixed formatting of alias names to still wrap but not replace underscores #8893
Fixed PHP errors from filter_rules_sort() when a configuration contains no rules #8993
Fixed PHP errors when creating schedules #9009
Fixed PHP errors when creating entries on NAT pages #9080
Fixed PHP errors from easyrule when no aliases are present #9119
Fixed “Drag to reorder” description in rule list when rule drag-and-drop is disabled #9128

Traffic Shaping (ALTQ/Limiters)¶

Fixed issues with Limiter queue display on upgraded configurations #8956
Fixed the default limiter scheduler to match previous version (WF2Q+) #8973
Added scheduler information to the limiter information page #8973

Packages¶

Fixed issues with package installation causing problems when crossing major PHP versions #8938
Fixed PHP errors when installing packages #9067

Backup/Restore¶

Added schedule (cron) support to AutoConfigBackup #8947
Fixed issues with AutoConfigBackup restoring a configuration from a different host #8901
Fixed the AutoConfigBackup menu from the deprecated package still showing when the package is no longer present #8959
Fixed an issue with Reinstall Packages hanging when run from Diagnostics > Backup & Restore #8933
Fixed issues with multiple <rrddata> tags in config.xml #8994
Fixed a race condition in package operations after a configuration restore that could lead to no packages being reinstalled #9045
Fixed issues with the External Config Locator not finding a config.xml in /config #9066
Fixed an issue where packages may not be reinstalled during a configuration restore performed immediately after a fresh install #9071
Fixed a stream_select() error when restoring packages #9102

Wake on LAN¶

Fixed issues with ordering of entries in Wake on LAN #8926
Added top control buttons to Wake on LAN for Add and Wake all Devices when there are more than 25 entries #8943

NTP¶

Fixed issues with NTP status when using noquery in the default permissions along with a specific ACL for localhost #7609

Logging / Notifications¶

Fixed an issue with log file sizes >= 2^32/2 #9081
Fixed PHP errors when saving log settings #9095
Added a checkbox to disable TLS certificate verification for SMTP notifications #9001

Install/Upgrade¶

Added a FAT partition to the installer memstick to make it easier to restore a config.xml file during the install process. Also includes a copy of the license and a README. #9104
Fixed PHP errors in upgrade code for IPsec #9083

Miscellaneous¶

Fixed HTTPS proxy authentication support for connections on the firewall itself #9029
Clarified wording of Kernel PTI options on System > Advanced, Miscellaneous tab #9026
Added a Save button to Status > Traffic Graphs to store default settings to use when loading the page #8976
Added support for nvme controllers to the S.M.A.R.T. diagnostics page #9042