FireBrick Model: FB6000 | FB2500 | FB2700 | FB2900 | FB9000 | SoHo/Plus | FB105

Model Variant: FB6202   Change to: (default is FB6202)

Software Versions: Older versions | Factory releases | Factory and Beta | Factory, Beta & Alpha

Released 2023-10-16
Built 2023-10-09
Current factory release
2.00.100 (Abbotscliffe)
Config:XSD Doc

Release notes from Factory release 1.61.010 to Factory release 2.00.100

  • Rework apps to run efficiently on the FB9000 platform - this is a major rework that may impact all platforms

ARP

  • Recover faster from certain subnet changes
  • Slightly improve ARP queue timeout handling for entries that do not resolve but are in constant use.

BGP

  • Shutdown timeout - be tolerant of negative NTP adjustments
  • Add profile to peer list in config editor
  • Check that peers define unique connections
  • Improvements to graceful restart
  • Improve connection handling
  • Fix issue with GET method for new SNMP OIDs
  • Additional states for shutdown and preshutdown in new OIDs
  • Add prefix limit info to SNMP
  • Include held routes in the count of imported prefixes
  • Improvements and bugfixes
  • Intersperse connection handling better

Config

  • Added auto-backup-url to config to POST changed config
  • Improve config patch mechanism
  • Fix "*" parsing for port ranges
  • Small improvements to the auto backup feature to make it nicer

CQM

  • Calculate times for XML output the same way as for images
  • Handle extremely low ping latencies better
  • Fix issues with speed data under some cirumstances

DNS

  • Prevent forwarding of other types for overridden DNS entries

Ethernet

  • Allow assignment of specific MAC addresses to subnets and interfaces
  • Improve diagnostic for unexpected buffers in the TX queue (FB6000)

Firewall

  • Only ARP targets in overlapping subnets if we would allow traffic to them
  • Improve source IP selection when NAT is targetting overlapping subnets
  • Add more detail to firewall diagnostic

Internal

  • Mitigation for rare watchdog
  • Improve resource utilisation of streams
  • Fix rare crash with inter processor communication

IPsec

  • Remove path by which eap-user restrictions could be evaded by some clients

IPv6

  • Advertise a /64 for PD SLAAC (even if the delegated prefix is larger)
  • Introduce a list of ra-subnet-template on interfaces to allow setting of options for RA generated subnets (replaces ra-client)
  • Prevent prefix delegation on linked interfaces (including by implicit defaults)
  • Fix issue with RA and ignore_dns that can cause subnets to be recreated

L2TP

  • Corrected handling of Framed-IPv6-Address as interface address in RADIUS
  • Add calling/called station IDs to L2TP session status
  • Fix crash with packets claiming different lengths in different ways
  • Allow IPv6 DNS to be overridden via RADIUS
  • Don't kill tunnels immediately when profiling off incoming
  • Report the correct number of packets for TX and RX

Logging

  • Increase internal logging capacity

Manual

  • Add more commands to the manual
  • Improve MIB appendix

MQTT

  • Reconnect faster on "external" config changes and improve status
  • Fix issue where tx is available late

OSPF

  • Fix crash when config changed repeatedly very rapidly

Pcap

  • Make labels on pcap form slightly better

PPPoE

  • Fix typo on PPP status page
  • Don't accept PPPoE inbound connections if the matching incoming is profiled off
  • Log sending the PADR

Profiles

  • Add uptime test to allow staggered starting of services
  • Evaluate conditions when adding (to avoid flapping without careful choice of initial)

Routing

  • Remove 6to4 (2002:) IP mapping
  • Add tunnel IDs to routing diagnostic summary
  • Avoid sending packets with potentially inappropriate source IPs (applies to overlapping subnets mainly)
  • Force immediate reconsideration routes when related gateways have expired

SNMP

  • Add system memory utilisation to SNMP
  • Make buffer statistics reflect new reality (that most buffers are in a global pool)

TCP

  • Improve preempting of TCP connections in the timewait state
  • Limit accept queues more consistently
  • Reduce resource usage when in TIME-WAIT

TLS

  • Add connection count to 1 second stats

VoIP

  • Improve how VOIP logging reads

VRRP

  • Take notice of the profile on the parent interface

Web UI

  • Improve profile switch behaviour when clicked fast repeatedly
  • Config option to change colours of user interface
  • Add buttons to config editor for reordering items in ordered lists
  • Darker background for select multiple selections
  • Avoid underflow when showing number of seconds remaining for config test (cosmetic)
  • Added warning that config save is recommended
  • Tidy up config edit page
  • Improve layout of BGP buttons
  • Show reboot now option when shutting down
  • Wrap lines in XML editor on first load
  • Buttons to delete flash blocks as a DEBUG user
  • Click on headings to sort status tables
  • Suppress iphone phone number autodetection (so it doesn't pick up the serial number)
  • Add arrows (ascending and descending) to sorting
  • Record txnodesc more like other ethernet stats
  • Add ability to view old configurations and boot alternative images to flash contents (as DEBUG)
  • Reorder ping form
  • Tweak upload styling
  • Show route diagnostic in prefix order
Released 2022-11-16
Built 2022-11-07
Older factory release
1.61.010 (Ogust)
Config:XSD Doc

Release notes from Factory release 1.60.010 to Factory release 1.61.010

Certificates

  • Avoid panic on reboot if FB private key gets deleted

Config

  • Enforce list max occurrences limits for all config items

CQM

  • Small change to SVG to make loss/latency squared off like png

DHCP

  • Treat a profile on a DHCP config entry with a restriction consistently with other config profile usage.

DHCPv6

  • Various improvements (especially in the client)
  • Make DHCPv6 work better with larger prefixes
  • Allow larger server DUIDs

Ethernet

  • Share MAC address on VLAN 0 between bootloader and app for each port

IKE

  • Send out of band error when INIT request negotiation fails

IPv6

  • Improved reliability of RA handling

MQTT

  • Bigger MQTT messages
  • Additional options on MQTT external
  • MQTT crash fix
  • Sending cleaner CONNACK for error cases

PPP

  • Bug fix for issues with PPP client corrupting subnets

PPPoE

  • Increase number of allowed PPP sessions (and fix crash loading configs with more than 20)

RADIUS

  • Juniper ERX ingress/egress policy name in RADIUS server
  • Correct defaulting of RADIUS server settings

Web UI

  • Improve layout on XML edit page
  • Improve button placement on system info pages
  • Explanation added regarding TCP stress test blob output
  • Further improve XML edit and reduce vertical height of top bar
  • Make XML download links look like links
  • Add line numbers to XML editor
  • Reject paths with extraneous middle segments
  • Various UI improvements
  • Add a config option to prevent refreshing the CQM image lists
  • Make graphs on the image list page clickable
  • Editor - fix colour picker with 3 digit hex colours
  • Force text colour in buttons to black (apparently ipads can default it to white)
  • Warn on most pages when config is no longer valid
Released 2022-07-20
Built 2022-07-11
Older factory release
1.60.010 (Nickell)
Config:XSD Doc

Release notes from Factory release 1.59.000 to Factory release 1.60.010

CLI

  • Show thread stats for longer sample period

DHCP

  • Improved controls over DHCP logging

DHCP/DNS

  • Additional "latest IP allocated" DNS name for DHCP - see auto-dhcp-new in DNS settings

DHCPv6

  • Simple DHCPv6 client mode (experimental)
  • Updated IPv6 SLAAC/RA logic to allow control of extra flags and simple ethernet side DHCPv6 server

Diagnostics

  • Provide info about HTTP connections for debug users on web and telnet

HA

  • Fix HA groups D-G
  • Improve handling of HA bonded tunnels with extremely mismatched latency (seconds)

HTTP

  • Be more tolerant of lack of Content-length in HTTP client

IP

  • Use the table's default source IP in more places

IPC

  • Fix rare lockup

IPv6

  • Interface setting ra-client now default if wan set, else not default
  • Interface setting now define PD (prefix delegation), default if wan/ra-client/ra not set

L2TP

  • Respect table setting for MTU calculation for outgoing and relayed L2TP connections
  • Add mechanism for advising LAC of tx speed when needed
  • Put serial number in calling station ID if explicitly set to ''

Logging

  • Fix issue with emailed logs - were sending to last MX not first, and leaving TCP open causing issues if too many emails sent

MQTT

  • Added MQTT console

PPP

  • Handle missed PAP reply on PPP

RADIUS

  • Added allow list for RADIUS CoA requests as alternative to host IP match
  • Add logging on RADIUS match
  • Added top level IP allow check on RADIUS
  • Faster RADIUS failover (and updated documentation)

VoIP

  • Limit email addresses for recording to 2000 chars

Watchdog

  • Eliminate a possible rare cause of watchdogs and improve diagnostics

Web UI

  • Add details of L2TP states session states on tunnel status pages
  • Show which tables session tracking is active on in UI
  • Fix looping causing loss of UI if TCP stress test fails
Released 2022-04-20
Built 2022-04-13
Older factory release
1.59.000 (Macleod)
Config:XSD Doc

Release notes from Factory release 1.58.111 to Factory release 1.59.000

ACME

  • ACME error reporting could get garbled message in some error cases

DHCP

  • Changed some DHCP server logging to be JSON format (same as used for MQTT)

FB105

  • Fix rare crash with FB105 tunnel bonding during configuration change

IPsec

  • Fixed a problem with validation of peer certificate
  • Fixed handling of out-of-order IKE fragments
  • There is a new attribute peer-eaplist available on an IKE connection config item which enables the allowed EAP usernames to be specified.
  • Improve EAP diagnostic logging and fix minor problem with message ID number checking
  • Further improvements to EAP processing and error logging

L2TP

  • Configured outgoing L2TP sessions now respect the bgp setting in the config

MQTT

  • Added listener for FireBricks/# topic
  • Changed MQTT mapping field names and fixed incorrect help text

OSPF

  • OSPF marked experimental as it has some minor issues.

RADIUS

  • Some additional RADIUS server settings, matching, added mqtt logging and changed log format to JSON, for working with some WiFi kit

Serial

  • Eliminate rare crash in serial rx handling

TLS

  • Improved stream handling in TLS to avoid occasional race conditions causing crashes

VoIP

  • Improve logging when bulk carrier import fails
Released 2022-01-05
Built 2021-12-21
Older factory release
1.58.111 (Landy)
Config:XSD Doc

Release notes from Factory release 1.57.010 to Factory release 1.58.111

Certificates

  • Removed expired DST Root CA X3 certificate

CLI

  • Added CLI command to view port status

Config

  • Allow numeric value with 0x prefix in config

DHCP

  • DHCP client will now attempt to renew leases when ports go down and come back up. This will automatically reconfigure the subnet if plugged into a different network.
  • Added mac-local test in DHCP pool
  • Improved DHCP allocation logging and MQTT logging

Diagnostics

  • Add diagnostic command and status page for buffer usage
  • Include uptime information in automatic crash reports
  • Log highest buffer users in case of exhaustion

Ethernet

  • Improve setting of default port config on startup (may be faster startup in some cases)

IPsec

  • Increase max number of simultaneous IKE/IPsec connections
  • Fixed problem with IKE message fragmentation causing connection failures with some clients
  • Fixed occasional "Response not pending" panic.

L2TP

  • Added session-timeout to L2TP incoming

MQTT

  • Simple MQTT message mapping option
  • Improvements to MQTT broker (better error reports and sanity checks)
  • MQTT payload pattern match
  • Correct mapped MQTT messages erroneously setting retain
  • Made IP a link on mqtt status
  • MQTT mapping connection linking (e.g. for retained)
  • Fix outgoing mqtt bug
  • Started some MQTT v5 handling (a config option, experimental, not recommend yet)

OSPF

  • Correct OSPF checksum issue for certain auth types

Profiles

  • Added profile test for "DHCP allocated"
  • Nicer web socket based profile control switches.
  • MQTT profile control fixed
  • Minor change, only sending MQTT if corresponding payload set (even if empty)

Serial

  • Improve reliability of config import via serial

TLS

  • Improve server authentication security and work around problems with some servers by using the signature algorithm extension.
  • Fix TLS connection failover
  • Added TLS stateless session resumption - without this newer versions of some browsers were very slow to load FB web pages
  • Issue with TLS resume keys used over a s/w upgrade fixed

Web UI

  • Fix setup wizard JS
Released 2021-09-29
Built 2021-09-15
Older factory release
1.57.010 (Kaplan)
Config:XSD Doc

Release notes from Factory release 1.56.010 to Factory release 1.57.010

ACME

  • Allow specifying of the source IP for ACME requests

BGP

  • BGP tags for static routes

Certificates

  • Fix problem with cross-signed certificates causing IPsec connection issues with Windows clients

Config

  • Allow delayed automatic upgrades

DHCP

  • DHCP option to force broadcast offer/ack to address edge case with some APs and devices

Ethernet

  • Fix over zealous ether damping

HTTP

  • Fixed issue where http client (e.g. ping graph download, etc) gets non 2XX response causing later problems

IPsec

  • Increase internal packet buffer size to help with IKE certificates
  • Fixed IP pool leakage
  • An IKE session was sometimes shown in waiting state as well as connected.
  • Further IPsec tweak to avoid losing connection in some circumstances
  • Add workaround to avoid repeated reauthentications when peer is StrongSwan and mode is immediate
  • Fix bad config status entry after deleting a live connection
  • Implemented IKE fragmentation to improve authentication with long certificate chains

L2TP

  • Slightly faster outgoing L2TP connect (proxy auth sent)
  • Handle incoming local match password check for PAP

PPPoE

  • Issue with some PPPoE sessions restarting on config change

Routing

  • Default source IP per routing table

Shaping

  • Additional control on shapers (burst limit in ms)

TLS

  • Added support for simple TLS clients with limited storage
  • Minor memory leak in TLS client fixed

VRRP

  • Make VRRP clearer when used with profiles (status page and manuals)

Web control pages

  • Configurable intro text and links on login page
  • Web access security update

Web UI

  • Add ethernet counters to web
  • Show which type of app upgrade would be initiated
  • Show some context lines in live logging view
Released 2021-04-16
Built 2021-03-24
Older factory release
1.56.010 (Jacoby)
Config:XSD Doc
Manual:PDF HTML

Release notes from Factory release 1.54.101 to Factory release 1.56.010

  • Fix bug in ASN.1 length encoding

Config

  • Additional options for finer control of source filtering setting
  • Additional help text for L2TP

CQM

  • Graphs used to show a damping level even when damping not in use (i.e. l2tp damping not set), removed

DHCP

  • Added "circuit" to the matching rules for DHCP server IP pool (circuit being Agent Info option 82 circuit sub option 1)

FB105

  • Change internal IP config for FB105 to allow IPv6 internal IPv6 to be set

HA

  • Some issues with invalid tunnel packets logging when using L2TP HAL
  • HAL did not work well if one of the links was rate limited
  • Increased number of HA sets to 7
  • Added additional hal-log for debug logging of HAL

IPv6

  • Slight change to SLAAC RA client default localpref so global addresses preferred

L2TP

  • Improved logging for incoming L2TP sessions so more obvious which config used
  • Minor changes to some L2TP config attribute names, and updates to manual
  • Correct logic on L2TP point to point speed controls on outgoing tunnel
  • Don't override manual shaper speeds on point to point L2TP where no speed is received from calling end
  • OSPF issues with incoming L2TP config fixed
  • L2TP tx/rx speed of -1 recognised and ignored
  • Issue with DOS limit on outgoing L2TP fixed

Manual

  • Clarifed that config access on web interface also needs user "admin" level

PPP

  • Tweaked PPP handling when far end wants to talk IPV6CP and we were not planning to. We now negotiate.

PPPoE

  • L2TP PPPoE BRAS mode now picks up payload-table from L2TP config.

SNMP

  • Integer values were sometimes misreported

Web control pages

  • Setup wizard bug when IPv6 defined

Web UI

  • Minor changes, allowing some javascript to be embedded
  • Experimental feature added to allow js-url in config (for when logged in, trusted IP, non password entry pages)
  • Tweak XML edit so that a zero login timeout does not fail if XML config edit is longer than 5 minutes
Built 2021-01-06
Older factory release
1.55.111 (Hamman)
[Withdrawn]
Config:XSD Doc
Manual:PDF HTML
This release has been withdrawn.

Release notes from Factory release 1.54.101 to Factory release 1.55.111

Config

  • Additional options for finer control of source filtering setting
  • Additional help text for L2TP

FB105

  • Change internal IP config for FB105 to allow IPv6 internal IPv6 to be set

HA

  • Some issues with invalid tunnel packets logging when using L2TP HAL
  • HAL did not work well if one of the links was rate limited
  • Increased number of HA sets to 7
  • Added additional hal-log for debug logging of HAL

IPv6

  • Slight change to SLAAC RA client default localpref so global addresses preferred

L2TP

  • Improved logging for incoming L2TP sessions so more obvious which config used
  • Minor changes to some L2TP config attribute names, and updates to manual
  • Correct logic on L2TP point to point speed controls on outgoing tunnel
  • Don't override manual shaper speeds on point to point L2TP where no speed is received from calling end
  • OSPF issues with incoming L2TP config fixed
  • L2TP tx/rx speed of -1 recognised and ignored

Manual

  • Clarifed that config access on web interface also needs user "admin" level

PPP

  • Tweaked PPP handling when far end wants to talk IPV6CP and we were not planning to. We now negotiate.

PPPoE

  • L2TP PPPoE BRAS mode now picks up payload-table from L2TP config.

SNMP

  • Integer values were sometimes misreported

Web UI

  • Minor changes, allowing some javascript to be embedded
  • Experimental feature added to allow js-url in config (for when logged in, trusted IP, non password entry pages)
  • Tweak XML edit so that a zero login timeout does not fail if XML config edit is longer than 5 minutes
Built 2020-05-26
Older factory release
1.54.101 (Garozzo)
Config:XSD Doc
Manual:PDF HTML

Release notes from Factory release 1.53.000 to Factory release 1.54.101

ACME

  • ACME status for certificates shows when last error happened.
  • Make ACME status clear at start up if clock not set yet
  • Fix ACME error status to show time of error

BGP

  • Add Refresh buttons to BGP UI status page

CLI

  • show configuration now allowed (redacted) at "view" level

Config

  • Improved syntax checking of numeric fields
  • Separate logging for http client accesses
  • Added new config access level (demo) allowing test but not commit/save config.

Config editor

  • Tweak to config edit to make default values more obvious

DHCP

  • Improve lease expiry when the FireBrick does not know the correct time

Ethernet

  • Improve DoS detection and logging of ethernet damping

HTTP

  • HTTP client requests now fall back to other IPs (e.g. for code updates, ACME, etc)

Internal

  • Scheduling changes to improve performance under heavy CPU load (eg crypto processing)
  • In some circumstances Watchdog panics may report incorrect thread - fixed.
  • Improve diagnostics if a "CPU1 stuck" error occurs.

IPsec

  • Avoid crash related to IPsec config logging settings when FB is under heavy load

IPv6

  • Handling of 6in4 (protocol 41) packet receipt from ethernet is now controlled on a per interface setting defaulting to FALSE
  • Prefix Delegation IPv6 address was using a base address not interface specific auto IP, fixed

L2TP

  • Configurable PPP timeout values per tunnel
  • Additional logging on config change
  • Fix payload table logic on local auth incoming L2TP sessions
  • Consistent NAS-Port attribute on RADIUS STOP records (previously was 0)

LACP

  • Prevent unnecessary continuous packet exchange

Logging

  • Avoid harmless unexpected interrupt log messages

Manual

  • Additional documentation on IPv6 prefix delegation and SLAAC

PPP

  • Tweak LCP restart timing for very slow latency links

Profiles

  • Profile ping of local gateway by ping 0.0.0.0

SNMP

  • Experimental addition of new-style vendor-specific structure to fit better with standard usage of OIDs/MIBs.

TLS

  • Use own server preferences when choosing crypto suite and EC curves; Do not send anchor certificate
  • Fix corner-case which may cause a TLS stream to go into limbo with TCP stuck in CLOSE_WAIT
  • Improve TLS session end - avoid occasional crashes/lockups.
  • Fix a couple of TLS issues causing problems with ACME and downloading large pages
  • Finally fixed TLS issue
  • Extra diagnostics added to help with occasional TLS crashes

VRRP

  • Incorrect error message for ID clash in VRRP, fixed

Web UI

  • Improve UI status reporting for bgp, including ability to filter routes list
Built 2019-08-29
Older factory release
1.53.000 (Flint)
Config:XSD Doc
Manual:PDF HTML

Release notes from Factory release 1.52.010 to Factory release 1.53.000

ACME

  • Control switch a CA name (e.g. "letsencrypt.org") profile during AMCE renewal validation phase
  • Added acme-profile, and made the renewal profile prefixed fb-, e.g. fb-letsencrypt.org
  • Tweak to ACME to allow for additional challenges for a few seconds

Certificates

  • Make certificate domain name checking case-insensitive

Config editor

  • Config edit of passwords did not work with & or similar escaped characters. Fixed, but passwords limited in length when editing config now (120 characters).

DHCP

  • Lease expiry times were incorrect when lease acquired before time had been set

DNS

  • DNS relay limit check

IPsec

  • Provide SNMP status info for IPsec
  • Fix crash when [id] is used in graph name of a waiting connection
  • Show EAP identity (username) in log messages and UI status, and allow it in graph names

IPv6

  • Avoid a problem seen with IPv6 fragmentation with some Linux stacks.

L2TP

  • Added pointless bearer capabilities to SCCRP as one carrier expects it for some reason!

PPP

  • New PPP debug log/dump format options

PPPoE

  • PPPoE did not install IPv4 DNS if explicit routes set, fixed
  • PPPoE Calling ID prefix appended with VLAN and/or MAC

TCP/UI

  • Fix TCP problem causing IPv6 fragmentation which was causing intermittent UI access problems.

TLS

  • Added capability for key exchange signing using SHA2 (needed for compatibility with latest versions of curl).
Built 2019-06-01
Older factory release
1.52.010 (Eisenberg)
Config:XSD Doc
Manual:PDF HTML

Release notes from Factory release 1.51.010 to Factory release 1.52.010

DNS

  • Added option to allow logging of DNS queries based on interface requesting the DNS

Factory reset

  • Changed factory default to allow set up from WAN as per quick start guide

IPsec

  • Fix problem with IPsec tunnels using IPv6 outer addresses

IPv6

  • Changed source IP of ND to link local in all cases - RFC allows any assigned address but some devices get upset

L2TP

  • Added Framed-IP-Address to accounting

LACP

  • Improvements to increase stability and reduce trunk downtime during status changes

Logging

  • Add Replay tag to panic/replay log lines displayed at startup

UI/CLI

  • Power monitoring improvements
Built 2019-05-17
Older factory release
1.52.000 (Eisenberg)
[Withdrawn]
Config:XSD Doc
Manual:PDF HTML
This release has been withdrawn.

Release notes from Factory release 1.51.010 to Factory release 1.52.000

DNS

  • Added option to allow logging of DNS queries based on interface requesting the DNS

Factory reset

  • Changed factory default to allow set up from WAN as per quick start guide

IPsec

  • Fix problem with IPsec tunnels using IPv6 outer addresses

IPv6

  • Changed source IP of ND to link local in all cases - RFC allows any assigned address but some devices get upset

L2TP

  • Added Framed-IP-Address to accounting

LACP

  • Improvements to increase stability and reduce trunk downtime during status changes

Logging

  • Add Replay tag to panic/replay log lines displayed at startup

UI/CLI

  • Power monitoring improvements
Built 2019-04-01
Older factory release
1.51.010 (Davies)
[Breakpoint]
Config:XSD Doc
Manual:PDF HTML

Release notes from Factory release 1.50.000 to Factory release 1.51.010

BGP

  • Added AS-Path checks to BGP route filtering

Config

  • Renamed log-panic to log-support, as we may log other unusual events to fb-support and not just stack trace / panics

Config editor

  • Profile page layout tweaked

DHCP

  • Revert minor change in DHCP/DNS which was causing problems

General

  • Some final tweaks before being ready for next release
  • Some minor optimisations

Internal

  • Minor changes to boot time calculation
  • Avoid boot time appearing negative when time is adjusted

L2TP

  • Adjustments to ICMP logic for trace route though L2TP
  • Various performance enhancements
  • Local config for L2TP relay now allows relay via another table (payload-table)
  • Fix missing TID in L2TP tunnel status page
  • L2TP session xml url checking number is only number

Logging

  • Additional direct log-panic logging to try and find specific issue in recent code.

NTP

  • Restructure client with minor improvements prior to introduction of full NTP server
  • NTP server introduced. Early release - may not be stable.
  • Support clients using older versions of NTP protocol
  • DHCP serves FireBrick IP for NTP now (unless otherwise set in DHCP config)
  • Minor fixes, and a change to maxpoll and minpoll to use duration in config.
  • Various minor updates on NTP
  • Further NTP bugfixes, including earlier setting of system time.
  • Further improvement to NTP system clock conditioning
  • Improve NTP status message on main status page
  • Added UI status page and CLI status; other minor improvements
  • Improved status output
  • Fix crash when adding/removing time service in config
  • Yet more UI status improvements
  • NTP time adjustments are now applied smoothly by OS time conditioning
  • Improved access checking
  • NTP control (ntpq) access now defaults to true. UI diagnostic access check page was not displaying correct details for NTP.
  • Fixed possible crash after peer drop
  • Fix problem with time quickstep (mainly showing on 2700)
  • Fix NTP status erroneously reported as Acquiring after config change. Improve NTP server stateup/shutdown.

Ping

  • Added ping size option to bulk ping logic (+size after IP and #table)

PPPoE

  • pd-interface default on PPPoE excludes interfaces marked wan

RADIUS

  • ERX-Tunnel-Switch-Profile untagged even in tagged responses (for Talk Talk working)

Shaping

  • Shared shaper changed to allow > 4Gb/s total (new version, so all sharing systems need update at same time)
  • Catch some edge cases in session tracking shaper set up that seem to cause a crash

Web control pages

  • Live update of uptime, time, and RAM usage in status page
  • Minor change to way status web page shows

Web UI

  • Minor tweaks to UI colouring. Ping/Traceroute display is banded for better visibility.
  • Fix typo in UI on TCP stress test page.
  • Fixed NTP status submenu highlighting
  • Improve page layout when left-hand menu pane is tall
Built 2019-03-24
Older factory release
1.51.001 (Davies)
[Withdrawn]
Config:XSD Doc
Manual:PDF HTML
This release has been withdrawn.

Release notes from Factory release 1.50.000 to Factory release 1.51.001

BGP

  • Added AS-Path checks to BGP route filtering

Config

  • Renamed log-panic to log-support, as we may log other unusual events to fb-support and not just stack trace / panics

Config editor

  • Profile page layout tweaked

General

  • Some final tweaks before being ready for next release
  • Some minor optimisations

Internal

  • Minor changes to boot time calculation
  • Avoid boot time appearing negative when time is adjusted

L2TP

  • Adjustments to ICMP logic for trace route though L2TP
  • Various performance enhancements
  • Local config for L2TP relay now allows relay via another table (payload-table)
  • Fix missing TID in L2TP tunnel status page
  • L2TP session xml url checking number is only number

Logging

  • Additional direct log-panic logging to try and find specific issue in recent code.

NTP

  • Restructure client with minor improvements prior to introduction of full NTP server
  • NTP server introduced. Early release - may not be stable.
  • Support clients using older versions of NTP protocol
  • DHCP serves FireBrick IP for NTP now (unless otherwise set in DHCP config)
  • Minor fixes, and a change to maxpoll and minpoll to use duration in config.
  • Various minor updates on NTP
  • Further NTP bugfixes, including earlier setting of system time.
  • Further improvement to NTP system clock conditioning
  • Improve NTP status message on main status page
  • Added UI status page and CLI status; other minor improvements
  • Improved status output
  • Fix crash when adding/removing time service in config
  • Yet more UI status improvements
  • NTP time adjustments are now applied smoothly by OS time conditioning
  • Improved access checking
  • NTP control (ntpq) access now defaults to true. UI diagnostic access check page was not displaying correct details for NTP.
  • Fixed possible crash after peer drop
  • Fix problem with time quickstep (mainly showing on 2700)
  • Fix NTP status erroneously reported as Acquiring after config change. Improve NTP server stateup/shutdown.

Ping

  • Added ping size option to bulk ping logic (+size after IP and #table)

PPPoE

  • pd-interface default on PPPoE excludes interfaces marked wan

Shaping

  • Shared shaper changed to allow > 4Gb/s total (new version, so all sharing systems need update at same time)

Web control pages

  • Live update of uptime, time, and RAM usage in status page
  • Minor change to way status web page shows

Web UI

  • Minor tweaks to UI colouring. Ping/Traceroute display is banded for better visibility.
  • Fix typo in UI on TCP stress test page.
  • Fixed NTP status submenu highlighting
  • Improve page layout when left-hand menu pane is tall
Built 2018-11-21
Older factory release
1.50.000 (Culbertson)
Config:XSD Doc
Manual:PDF HTML

Release notes from Factory release 1.49.000 to Factory release 1.50.000

ACME

  • Minor improvements to ACME - handling some extra order status responses

BGP

  • Additional debug for ignored updates

CQM

  • Added more stats (total bytes/packet/drops) to CQM XML

Crypto

  • PKCS#8 formats now fully accepted and served for RSA and DSA keys

Diagnostics

  • Fix TCP download test (was always saying 0 bytes loaded)

DNS

  • Changed DNS logic so not simply fallback="true" but fallback-table defined. This means multiple table DNS will default not to fall back now.

General

  • Slight performance improvements

IPsec

  • Fix duplicate connection problem after roadwarrior client switches from wifi to 3G
  • Fix Roadwarrior problems - IPv4 NAT not working and IPv6 routing failing on Apple clients

IPv6

  • Changed ICMPv6 (ND/NA) source address in some cases to match scope

L2TP

  • Allow L2TP matched incoming sessions to set payload-table
  • Added colours to tunnel and session status

Logging

  • Fix possible syslog buffer overrun

Pcap

  • Improved pcap "self exclude" to only exclude the actual TCP session traffic of the dump, not all traffic to/from the IP of the browser as before

PPPoE

  • Minor change to PPPoE timeout logic - could be disrupted by frequent profile changes

RADIUS

  • Platform RADIUS server ERX parameters now tagged if part of tagged response

Routing

  • Impove some logic where table 0 has no routes and totally mapped via rule-sets (e.g s/w upgrades, etc)

Telnet

  • Option to configure custom telnet prompt

TLS

  • Fix lockup at end of stream on TLS connections

VRRP

  • VRRP low-priority mode (e.g. for profile off) caused flapping

Web control pages

  • User setting to hide "save" button in config edit (i.e. has to do "test" first).
  • Added Content-Language to avoid some browsers offering to translate control pages
  • CSS update
  • Adjust initial timeout to allow for slow TLS handshake
Built 2018-08-22
Older factory release
1.49.000 (Belladonna)
Config:XSD Doc
Manual:PDF HTML

Release notes from Factory release 1.48.101 to Factory release 1.49.000

BGP

  • Added startup delay for sending BGP announcements to make for cleaner reboots when used as part of a part

Config

  • Tweaked factory default LAN firewall rule to allow from FireBrick to LAN (needed for VoIP)
  • Removing Ethernet port config now sets port back to default settings

CQM

  • Tweak graph logic - was not working if only selecting ave or max latency to show on SVG

FB105

  • Fix internal-ip on fb105 tunnels routing

HTTP

  • Changed HTTP redirect logic to better handle cases where some port mapping is used in front of the web control pages

IPv6

  • Added DNSSL (search list) to RA settings on subnet

L2TP

  • Minor change to handle low buffer scenarios better

Logging

  • Fixed UTC timestamp on logs (was local time with Z suffix, sorry)

PPPoE

  • PPPoE can now be linked to physical port for direct connection to modem - resetting the port when PPPoE goes down (fixes bug in some modems)

SNMP

  • Various SNMP updates
  • bgp and l2tp now support SNMP treewalk
  • Vendor-specific SNMP for BGP and L2TP reorganized to follow standard table construction. ***NOTE*** this will affect customers using SNMP with BGP/L2TP
  • Add CPU buffer free counts to SNMP statistics

VoIP

  • Tweak for REFER logic, allow refer to match user details with no password (i.e. check IP)

VRRP

  • Corrected VRRP v3 checksum - UPGRADE BACKUP ROUTERS FIRST

Watchdog

  • Watchdog detection of CPU1 failure (CPU1 stuck) modified to allow recovery, hopefully giving better diagnostics

Web control pages

  • New css for mobile use
  • Fix wizard when email specified as it caused save error
  • New control of whether logs on web/cli include system logs or not (default not, except for "default" log after factory reset)
  • Config edit not working when clock not set, fixed.
  • Recovery config edit now prompts to save even when no changes as it is not the "live" config
  • Minor improvements to web control pages (extra classes, etc)

Web UI

  • Add TCP throughput diagnostic
Built 2018-06-22
Older factory release
1.48.101 (Avarelli)
Config:XSD Doc
Manual:PDF HTML

Release notes from Factory release 1.47.100 to Factory release 1.48.101

ACME

  • Install root certificates for use with Let's Encrypt and ACME
  • Better error logging
  • Full ACME system to work with Let's Encrypt

BGP

  • Updates BGP refresh options including sending refresh request
  • Additional BGP shutdown subcodes added
  • Some additional debug for BGP

Config

  • Config top level attributes now include username and ip of last update
  • Config top level attributes now include serial number and version, but normal edit screen no longer has xmlns and xsi
  • IP groups can now reference subnets by name (including DHCP client subnets)

Crypto

  • New key generation logic in place for ACME and related functions
  • Avoid crash soon after startup following auto key generation

Flash

  • Fix incorrect detection of flash timeout on heavily-loaded system

https

  • Self signed certificates as fallback for initial set up via https

Internal

  • Fix occasional lockup/crash during stream processing
  • Additional stats for entropy collection

IP

  • Increase pending ARP cache and drop if overloaded rather than sending spurious ICMP errors

IPv6

  • Change some logic to reduce use of 2002:: 6over4 address usage as source addresses where possible

L2TP/RADIUS

  • Tweaks to expected timeouts on RADIUS (e.g. for L2TP or session steering) and change default to min timeout 2 seconds total
  • More control of RADIUS timeouts for ad-hoc RADIUS from RADIUS response for L2TP session steering
  • Improve outgoing L2TP handling where target is hostname

Logging

  • Change to outgoing email timeout (spam scans and the like can take a while) RFC5321 4.5.3.2
  • Colour on web log not always correct

PPP

  • Send NAK asking for MD5 on receipt of non MD5 CHAP request

RADIUS

  • RADIUS client allowing fixed source-ip, and for ad-hoc L2TP steering uses L2TP source IP if set
  • Fix L2TP relay steering RADIUS min/max timeouts (5/20 not 20/5)

Web control pages

  • Change layout of rule-set
  • Changed logic for self signed certificates, and made more transient in certificate store
  • Limit number of self signed certificates to reduce clutter, and avoid possible "make millions of certificates" attacks
Built 2018-04-19
Older factory release
1.47.100 (Zander)
Config:XSD Doc
Manual:PDF HTML

Release notes from Factory release 1.46.100 to Factory release 1.47.100

Authentication

  • Interface can be marked "wan" to consider it not local for "local-only" access controls
  • Added advice on printing and storing QR code in case phone fails

BGP

  • New "grey hole"community tag for IBGP to pass blackhole routes that have no-fib set, so routes get to EBGP for external blackhole announcements
  • More info on BGP peers

Config

  • Config editor did not show advanced selected option entries that are blank if without Show all

Config editor

  • Adjust timing on config edit as firefox keeps saying edited by someone else

CQM

  • More slight tweaks - edge case of SVG for unknown CQM graph (i.e. blank graph) with title text enabled caused a crash...
  • Slight changes to SVG (slightly bigger) to add id to some fields and include off image (cropped) data to allow some post processing (e.g. merging graphs)
  • CQM SVG now includes option for markers on the tx/rx lines like the old PNGs did - by popular demand, CSSable.
  • SVG CQM graphs did not show "damping"

DHCP

  • DHCP client Class and Client-Identifier now configurable
  • Minor tweaks to DHCP server as per RFC6842 (correctly returning client ID)

Internal

  • Fix incorrect flash log replay output at system startup
  • Minor change to low buffer checks for TCP management interfaces and L2TP

L2TP

  • PPP LCP restart if not negotiated after 30 seconds and an LCP restart has not been tried already
  • Added RADIUS Framed-IPv6-Prefix
  • Option to mark an L2TP session as isolated, i.e. not allowed to pass directly from another L2TP session
  • Added relay-local-ip config for L2TP to control the IP used for relaying connections, and extra debug info
  • Tweak behaviour if all RADIUS servers not responding
  • Malformed L2TP packet could cause crash

LEDs

  • Ensure LEDs start up in cycling (knightrider) mode

Logging

  • Syslog missing NILVALUE for structured data
  • Some additional logging for impossible packet headers requiring split for MTU
  • Tweak to delayed logging (email) so it may send on controlled shutdown

Manual

  • Corrected explanation of trusted, local-only, and allow controls in manual
  • Updates to manual covering scripted access and special URLs

Ping

  • Show ping/traceroute response coming back on wrong table

PPPoE

  • PPPoE was not handling priority tagged VLAN packets well
  • Tweak to PPPoE client back-off when connections start but don't complete

Profiles

  • Profiles now allow checking of outgoing L2TP tunnel state

Routing

  • Changed linked routes display, e.g. for L2TP sessions, to be more logical

SNMP

  • SNMP was not respecting profile setting

SVG

  • Minor SVG tweaks to save space
  • Extra info in SVG to aid post processing

Telnet

  • Fix instructions on telnet config import. It ends with ^D or a line with just a dot on it

USB

  • Remove unnecessary logging

Web control pages

  • https support introduced. Should now support most modern browsers. Limited certificate management.
  • Change of monospace font
  • Dynamic status of ports
  • Started work on initial config wizard
  • Warning for config edited by someone else now advises IP and name of other user(s)
  • Tidy layout of config edit for system settings
  • Option to skip the setup wizard
  • DHCP clear all unused now operates per interface
  • Colour picker was not working for named colours (also, added "orange")
  • Additional security related http headers added with sensible defaults
  • Change ajax sync logic on config edit to be neater
  • TLS: Added AEAD-GCM cipher suites - now get an "A" rating with Qualys SSL Labs test.
  • Can now specify a list of possible certificates to be used for https in http config
  • The logs page was not working when you only had one log target. Given system defaults to two to start, this is rare!
  • Save button appearing on key press in a field, and not just when leaving field - so more obvious
  • Slight re-order of the config to be a little easier to follow

Web UI

  • More compact SVG for CQM and QR codes
  • Status shows currently ntp status, i.e. reports if no time server set, DNS not working, etc.
  • DHCP status now lists interfaces and shows per interface rather than all in one table
Built 2018-04-11
Older factory release
1.47.010 (Zander)
[Withdrawn]
Config:XSD Doc
Manual:PDF HTML
This release has been withdrawn.

Release notes from Factory release 1.46.100 to Factory release 1.47.010

Authentication

  • Interface can be marked "wan" to consider it not local for "local-only" access controls
  • Added advice on printing and storing QR code in case phone fails

BGP

  • New "grey hole"community tag for IBGP to pass blackhole routes that have no-fib set, so routes get to EBGP for external blackhole announcements
  • More info on BGP peers

Config

  • Config editor did not show advanced selected option entries that are blank if without Show all

Config editor

  • Adjust timing on config edit as firefox keeps saying edited by someone else

CQM

  • More slight tweaks - edge case of SVG for unknown CQM graph (i.e. blank graph) with title text enabled caused a crash...
  • Slight changes to SVG (slightly bigger) to add id to some fields and include off image (cropped) data to allow some post processing (e.g. merging graphs)
  • CQM SVG now includes option for markers on the tx/rx lines like the old PNGs did - by popular demand, CSSable.
  • SVG CQM graphs did not show "damping"

DHCP

  • DHCP client Class and Client-Identifier now configurable
  • Minor tweaks to DHCP server as per RFC6842 (correctly returning client ID)

Internal

  • Fix incorrect flash log replay output at system startup
  • Minor change to low buffer checks for TCP management interfaces and L2TP

L2TP

  • PPP LCP restart if not negotiated after 30 seconds and an LCP restart has not been tried already
  • Added RADIUS Framed-IPv6-Prefix
  • Option to mark an L2TP session as isolated, i.e. not allowed to pass directly from another L2TP session
  • Added relay-local-ip config for L2TP to control the IP used for relaying connections, and extra debug info
  • Tweak behaviour if all RADIUS servers not responding
  • Malformed L2TP packet could cause crash

LEDs

  • Ensure LEDs start up in cycling (knightrider) mode

Logging

  • Syslog missing NILVALUE for structured data
  • Some additional logging for impossible packet headers requiring split for MTU
  • Tweak to delayed logging (email) so it may send on controlled shutdown

Manual

  • Corrected explanation of trusted, local-only, and allow controls in manual
  • Updates to manual covering scripted access and special URLs

Ping

  • Show ping/traceroute response coming back on wrong table

PPPoE

  • PPPoE was not handling priority tagged VLAN packets well
  • Tweak to PPPoE client back-off when connections start but don't complete

Profiles

  • Profiles now allow checking of outgoing L2TP tunnel state

Routing

  • Changed linked routes display, e.g. for L2TP sessions, to be more logical

SNMP

  • SNMP was not respecting profile setting

SVG

  • Minor SVG tweaks to save space
  • Extra info in SVG to aid post processing

Telnet

  • Fix instructions on telnet config import. It ends with ^D or a line with just a dot on it

USB

  • Remove unnecessary logging

Web control pages

  • https support introduced. Should now support most modern browsers. Limited certificate management.
  • Change of monospace font
  • Dynamic status of ports
  • Started work on initial config wizard
  • Warning for config edited by someone else now advises IP and name of other user(s)
  • Tidy layout of config edit for system settings
  • Option to skip the setup wizard
  • DHCP clear all unused now operates per interface
  • Colour picker was not working for named colours (also, added "orange")
  • Additional security related http headers added with sensible defaults
  • Change ajax sync logic on config edit to be neater
  • The logs page was not working when you only had one log target. Given system defaults to two to start, this is rare!
  • Save button appearing on key press in a field, and not just when leaving field - so more obvious
  • Slight re-order of the config to be a little easier to follow

Web UI

  • More compact SVG for CQM and QR codes
  • Status shows currently ntp status, i.e. reports if no time server set, DNS not working, etc.
  • DHCP status now lists interfaces and shows per interface rather than all in one table
Built 2017-11-26
Older factory release
1.46.100 (Yorick)
[Breakpoint]
Config:XSD Doc
Manual:PDF HTML

Release notes from Factory release 1.45.001 to Factory release 1.46.100

ARP

  • Proxy ARP/ND logic was causing proxy ARP even when routing is to a next hop on same LAN, and so hijacking all IPs
  • Improvements to ARP handling - reduce chances of unexpected no route to host on first packet

ARP/DHCP

  • Timing improvements to prevent corner case of IP not getting allocated if recently unused

BGP

  • Export filters were not checking community fields on non BGP originated routes (e.g. locally generated with community tags)
  • Show more clearly when BGP has hit prefix limit (we don't drop BGP on that)
  • Added reduce-recursion option to BGP
  • No fib option on Blackhole routes (EBGP only and non FIB)

CLI

  • Eth/Switch stats display layout improved
  • Command completion was not working correctly
  • show tasks allows stack trace information for debug

Config

  • Minor change to factory reset config (WAN port name changes)
  • Port LED config option "Cycling" removed. [May be reinstated in the future.]
  • Config edit was reporting that someone else had changed config, on save...
  • Minor change to way simultaneous config changes are reported on web pages

CQM

  • SVG for CQM graphs

DHCP

  • Additional DHCP logging, and (debug) logging if seems to be another DHCP server present
  • Improved logging when no IP is available to help with diagnosis
  • Fix problem where wrong restricted dhcp entry could be used

DNS

  • Option to turn off local caching of relayed DNS lookups
  • DNS response times made a bit more adaptive to handle cruise ship levels of internet latency
  • DNS config allows resolvers table to be specified without restricting access to DNS caching function
  • Tweaks to DNS handling capacity for high load
  • Some aspects of local DNS were case sensitive, fixed
  • Fix for local IP (e.g. my.firebrick.uk) not returning A record when IPv6 DNS used, and other way around.

Ethernet

  • Fix slow port initialisation on image reload

Internal

  • Another modification to interrupt management to help with overload
  • Changes to image timestamp processing to avoid occasionally seen wild timestamps way in the future.
  • Improved error detection and recovery in legacy flash driver

L2TP

  • Changed L2TP tunnels to have two separate "LIVE" states on web page and on SNMP, one for incoming and one for outgoing tunnels
  • New L2TP config option to allow both LAC and LNS as NAS IP and port in RADIUS
  • Allow RADIUS relay response to have #port on end of IP/hostname for non standard RADIUS auth port
  • Added additional SNMP L2TP for session negotiation slots that are free: iso.3.6.1.4.1.24693.1701.2.10
  • Using web page to kill L2TP session bypassed normal RADIUS accounting for closing session

LEDs

  • LED driver restructuring and timing improvements

Logging

  • Added email address to config - used as Reply-To on email logs
  • Rework of web logging to use web sockets and better layout, and allow download

NAT

  • Changed NAT logic to have longer session timeout after TCP closes to avoid accidental re-use of ports in FIN WAIT

PPP

  • Buffer leak in edge case where PPP negotiation is closing IPCP and failing the session

PPPoE

  • DHCPv6 over PPPoE server was broken, fixed
  • PPPoE server (BRAS mode) now allows calling station ID prefix for sending to RADIUS

RADIUS

  • RADIUS server matching rules can be set to continue on match, allowing multiple stages of settings if needed
  • Added additional Juniper parameter to steering RADIUS for L2TP via TalkTalk newer platform
  • Added additional check on NAS-IP in steering RADIUS for L2TP via Talk Talk newer platform
  • Platform RADIUS nas-ip match was not right

s/w upgrade

  • Delay up to 15 mins to give FB a chance to get the time before performing an auto upgrade; Correct logic for checking if image already present in flash.

Serial CLI

  • Ignore linefeed characters on serial line input - some serial converter servers send these unnecessarily

SNMP

  • SNMP 1.3.6.1.2.1.2.1.0 was not working

Web UI

  • Sometimes the login page could show a corrupt hostname for connecting host (reverse DNS)
  • Changed to use svg for images because of higher res screens and scalable mobile screens
  • Change form entry timeout to match login timeout (if set, else 5 minutes as now)

Older versions | Factory releases | Factory and Beta | Factory, Beta & Alpha