OPNsense 22.1, codenamed “Observant Owl”, has been released. This major release brings fundamental changes to the logging system and numerous improvements for network operations.
Release Highlights
New Logging with Syslog-ng
The most important change in OPNsense 22.1 is the switch of the logging system:
- Syslog-ng replaces the previous syslog system
- Significantly more flexible log filtering and forwarding
- Improved remote logging options
- Structured log output
- Better integration with SIEM systems
Unbound DNS Improvements
The integrated DNS resolver has been comprehensively improved:
- Updated Unbound DNS with performance optimizations
- Improved DNS-over-TLS support
- Extended DNSSEC functionality
- Optimized cache management
- Improved DNS blocklist integration
Firewall Improvements
- Redesigned alias management with improved performance
- Extended GeoIP database updates
- Optimized rule processing for large rulesets
- Improved live log with real-time filtering
VPN Updates
- Updated WireGuard kernel module
- Improved OpenVPN client and server
- Optimized IPsec management
- Extended VPN status overview with throughput display
Intrusion Detection
- Updated Suricata IDS/IPS
- Improved ruleset management
- Optimized performance at high throughput
- Extended alert categorization
Web Interface
- Modernized design
- Improved MVC-based pages
- Faster loading times
- Extended diagnostics tools
- Improved API documentation
Security Updates
- Updated base to FreeBSD 13.0-p6
- OpenSSL security updates
- PHP updates
- Various CVE fixes
Migration from 21.7
The upgrade from OPNsense 21.7 to 22.1 can be performed via the web interface. Due to the switch to Syslog-ng, existing log configurations should be reviewed after the upgrade.
Conclusion
OPNsense 22.1 is an important release that brings significant progress with the new Syslog-ng-based logging and the Unbound DNS improvements. As an experienced OPNsense integrator, we are happy to advise you on planning and implementing your firewall infrastructure.
More on these topics:
More articles
Vaultwarden: Self-Hosted Password Manager for Teams
Run Vaultwarden as a self-hosted password manager: Docker deployment, reverse proxy, SMTP, 2FA enforcement, and backup strategy — the complete guide for teams.
Fail2ban: Automating Brute-Force Protection for Linux Servers
Install and configure Fail2ban: log parsing, jail.local, protecting SSH, Nginx, Postfix, and Dovecot, whitelists, email alerts, and a comparison with CrowdSec, sshguard, and CSF.
TrueNAS Dataset Encryption: ZFS Encryption in Practice
Understanding and implementing TrueNAS ZFS Encryption: dataset vs. pool encryption, passphrase vs. key file, key management, and performance impact with AES-NI.