Table of Contents

PFSense - Upgrade PFSense

IMPORTANT: Do not upgrade packages until after you have updated pfSense itself.


Take a backup

Navigate to Diagnostics → Backup & Restore.

and ensure that you select Save before clicking on OK.

The file should be save to your Download directory, for example:

config-pfSense.localdomain-20200409161149.xml

Prepare a fall back plan

Plan for how to recover beforehand.

Write a USB stick to have the latest pfSense image file available on it.

If the upgrade fails for some reason, you could reinstall it from this USB stick, and then just reapply the changes you need.

As an extra step, you could also have a another USB stick written with the current pfSense image file.

This would allow you to revert the system to the existing version if really needed.


Remove packages

It is recommended to remove all packages before upgrading pfSense to a new release.

Make a note the installed packages, remove them, perform the upgrade, and then reinstall necessary packages.

NOTE: Many packages, such as pfBlockerNG have options to remember the configuration you have set, which once you reinstall the package after the upgrade will reset the configuration you had:


Pre-Upgrade Reboot

Reboot before doing any update attempt.


Perform the Update

From the GUI:

Navigate to System → Update.


Update manually (optional)

From the console or ssh:

and run:

pfSense-upgrade

An alternative method is to use the following commands from the console or shell:

pkg-static clean -ay; pkg-static install -fy pkg pfSense-repo pfSense-upgrade

Force a reinstall of everything:

pkg-static upgrade -f

Review the list of changes and enter y to proceed.

Manually reboot the firewall.


Troubleshooting

Check the update log

A log of the last update attempt is located at /conf/upgrade_log.latest.txt.

If the update check fails, or the update does not complete, run the following to ensure that pfSense-upgrade is present.

pkg-static update 
pkg-static upgrade -fy
 
pkg install -y pfSense-upgrade

Could also try, after choosing Option 8,

ifconfig
cpsw0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8000b<RXCSUM,TXCSUM,VLAN_MTU,LINKSTATE>
        ether 68:9e:19:9c:a6:59
        hwaddr 68:9e:19:9c:a6:59
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
...

Use the first NIC shown above in the following:

dhclient cpsw0 
pkg-static update 
pkg-static upgrade -fy

References

https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html

https://docs.netgate.com/pfsense/en/latest/install/upgrading-pfsense-software-installations.html

https://docs.netgate.com/pfsense/en/latest/install/upgrade-troubleshooting.html

https://files.pfsense.org/hashes/