Hi there,

For five and a half years, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.

We thank all of you for helping test, shape and contribute to the project! We know it would not be the same without you. <3

Download links, an installation guide[1] and the checksums for the images can be found below as well.

- Europe: https://mirrors.dotsrc.org/opnsense/releases/20.7/
- US East Coast: http://mirrors.nycbug.org/pub/opnsense/releases/20.7/
- US West Coast: https://mirror.sfo12.us.leaseweb.net/opnsense/releases/20.7/
- South America: https://mirror.venturasystems.tech/opnsense/releases/20.7/
- Australia: http://mirror.as24220.net/opnsense/releases/20.7/
- Full mirror list: https://opnsense.org/download/

Here are the full patch notes against 20.1.8_1:

- system: allow to optionally disable legacy logging (clog)
- system: do not allow login redirects to visit external pages
- system: add new "auth user changed" config event and hook it into LDAP updatePolicies()
- system: adapt to 3wire serial console setting
- system: figure out which sysctls are writeable before attempting to write them
- system: Windows-friendly Nextcloud configuration backup file timestamp (contributed by Alphakilo)
- system: disable PCRE JIT in PHP config
- system: clean up start / stop beep handler
- interfaces: improved VLAN handling and defaults for more stable netmap use on 12.1
- interfaces: support DHCPv6 multi-WAN (contributed by Team Rebellion)
- interfaces: show delegated prefix in overview (contributed by Team Rebellion)
- interfaces: DHCPv4 no-release and debug options moved to global interface settings
- interfaces: automatically register loopback device lo0
- firewall: handle new net.pf.request_maxcount system limit accordingly
- firewall: properly evaluate and execute gateway monitoring kill states feature
- firewall: add the iplen option to shaper rules (contributed by Maxfield Allison)
- firewall: show partial alias content in tooltip
- firewall: translated static log overview page to MVC
- firewall: aliases now show internal aliases
- firewall: validate if NAT destination contains a port
- firewall: prevent config_read_array() from adding an empty lo0
- firmware: added fingerprint for 20.7 series
- firmware: hint at missing plugins and request to install or dismiss
- intrusion detection: extend rule search with metadata and show results on rule info
- intrusion detection: updated pattern options (contributed by Xeroxxx)
- intrusion detection: synchronize suricata.yaml with default template
- network time: NMEA GPS clock messages latitude and longitude parsing fix (contributed by mikahe)
- network time: prevent widget PHP warnings if no GPS fix was returned in NMEA message (contributed by mikahe)
- unbound: integrate functionality formerly known as "unbound-plus" plugin (contributed by Michael Muenz)
- web proxy: support for custom error pages (sponsored by Incenter Technology)
- web proxy: add connect_timeout (contributed by Michael Muenz)
- web proxy: allow PURGE on cache (contributed by sazb)
- web proxy: add missing IPv6 listener
- mvc: add "S" option for AllowDynamic in InterfaceField type
- mvc: LegacyLinkField not allowed to return null in __toString()
- backend: add safeguard for illegal configd settings leading to overrides on the same command leaf
- backend: emove undocumented and unused alias support
- mvc: support virtual nodes in model instances
- rc: implement inline variables for skip and defer service start
- ui: unify edit dialog and add onBeforeRenderDialog event deferrable
- ui: use firewall groups to group interfaces menu accordingly
- ui: moved virtual IP menu entry to interfaces
- ui: jQuery 3.5.1
- plugins: os-dyndns 1.22[2]
- plugins: os-intrusion-detection-content-et-pro 1.0.2 switches to Suricata 5 rules
- plugins: os-telegraf 1.8.1[3]
- plugins: os-theme-rebellion 1.8.6 (contributed by Team Rebellion)
- plugins: os-tinc fixes switch mode[4]
- plugins: os-wireguard 1.2[5]
- src: HardenedBSD 12.1-p7
- ports: ca_root_nss 3.54
- ports: curl 7.71.1[6]
- ports: php 7.3.20[7]
- ports: python 3.7.8[8]
- ports: sqlite 3.32.3[9]
- ports: suricata 5.0.3[10]

Known issues and limitations:

- Legacy MPD plugins os-l2tp, os-pppoe and os-pptp will no longer be available
- i386 architecture builds will no longer be available
- Installer still advertises 20.1

The public key for the 20.7 series is:

    -----BEGIN PUBLIC KEY-----
    MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAngIbBcRin9AmDSOsjpft
    7aK52TLkOzRc94NqKKnn6ALd6poEuFqYl1tfNT6XumBJDsRL1s56UYfjS8zpvFW3
    HdzKOv4YtIln6qUuC1w8TXYNprasB/laYoBn2xeCGX5L6carlujQ+h0rsj+kpawr
    E0/d6oRzR69cxQyoDQHD559Wv4nA795M6QGDhhl3dDq/92gzrrq3C5gJ7ldHi13c
    inM2Fw+oPUfEIWUt/sqUTZheEk0Df3LSiJlgjQDhjh5uujTLgvX8IzfYAb8clgY3
    DplgOh4ReoFnx6XVERSPa91ZJGeCV4dTGD2hU40rzU1lkQaiVUITLsfjrYUsNMEo
    jdG+ndGIPTOrwXH4yGRZuUZZ612ALtO6bd4V1kAOLOS07mo4JB4poEbbB0lvZJSG
    iTmU9od8zutnLkD66Q/qI8e6OcL0yqjwwG9DzCKg23M6cVWfyBTJhKoqQyhNWnzZ
    bzvgOXfhOA8jn8FPChaU5OiIrv+g56pQrWKcQsvgQMqlyR+/AFSIrrqprCjDkfOG
    bxFqTGkPb1n32nbnXJOA5Z43G9/PtBV8lvaEzli6Vehh+Zrcuy8yupbiVWSqTOfp
    E5cYAmrlDkxKyAlZQtH6EhMF1VBQRrlqGhss5XYoE3DQDqWdhUbGv8Qiiv7ROCza
    SIMuSzc6u35MooDRDZF4Ba0CAwEAAQ==
    -----END PUBLIC KEY-----

Please let us know about your experience!

Stay safe,
Your OPNsense team

    SHA256 (OPNsense-20.7.r1-OpenSSL-dvd-amd64.iso.bz2) = d54dca6390497d45b831f68f352fccf84881aac78a360247965e5c9b36fbfded
    SHA256 (OPNsense-20.7.r1-OpenSSL-nano-amd64.img.bz2) = f78d51d53bf663df2d49a3724812893d8c55234ab8d4a9232663fa581496edbe
    SHA256 (OPNsense-20.7.r1-OpenSSL-serial-amd64.img.bz2) = 984f8c9d63598f061cc8995245dea73703532c1bb688ac87cdb1e510fb53b80e
    SHA256 (OPNsense-20.7.r1-OpenSSL-vga-amd64.img.bz2) = 711811e0a7d37d323a060c52590daa9f024e77c6da627530c6596367a09b412d