Feature History¶
This page documents significant feature changes across t1n1wall's development branches (FreeBSD 8 through FreeBSD 15) for operators who need to understand what changed between versions or who are migrating from an older release.
t1n1wall tracks FreeBSD major versions as its branching model. Each branch rebuilds the OS and toolchain for the corresponding FreeBSD release.
Branch summary¶
| Branch | FreeBSD version | Status |
|---|---|---|
| freebsd8 | FreeBSD 8 | End of life |
| freebsd10 | FreeBSD 10 | End of life |
| freebsd11 | FreeBSD 11 | End of life |
| freebsd12 | FreeBSD 12 | End of life |
| freebsd15 | FreeBSD 15 | Current |
Note: freebsd9 was not released.
FreeBSD 8 → FreeBSD 10¶
DHCP backend change¶
ISC dhcpd replaced by dnsmasq. The DHCP server and DHCP relay were previously handled by ISC dhcpd. From FreeBSD 10 onward, dnsmasq handles both DNS forwarding and DHCP. This reduced image size significantly (~775 KB) and unified DNS and DHCP into one process.
Impact on configuration: DHCP configuration remains in Services > DHCP Server but the underlying daemon changed. The ARP table and DHCP lease views were updated accordingly.
IP Pools added¶
IP Pools were introduced as a new firewall concept. Pools are address sets that can be referenced as pf tables in firewall rules and populated dynamically by the DNS forwarder. See DNS Forwarder, IP Pools, and pf Tables.
Advanced system settings¶
TCP Segmentation Offloading (TSO) and fast forwarding toggles were added to System > Advanced.
FreeBSD 10 → FreeBSD 11 (major release)¶
This transition involved the most significant architectural change in t1n1wall's history.
Firewall: IPFilter → pf¶
The packet filter was migrated from IPFilter to pf (Packet Filter). All firewall rule logic, NAT configuration, and diagnostics were rewritten for pf.
- IPFilter kernel patches removed
- pf state monitoring added (
pfmonutility) diag_ipfstat.phpretained the historical name but now reads pf state data- IP Pools reworked to use pf tables (
<tablename>syntax) - Firewall rules, NAT rules, and traffic shaper rules all use pf semantics
All documentation on this site uses pf terminology. References to ipfilter, ipf, or ipnat in any older third-party documentation do not apply to current t1n1wall deployments.
DHCP client: dhclient → dhcpcd¶
The WAN interface DHCP client was replaced. dhclient was replaced by dhcpcd. This affects how WAN DHCP lease negotiation behaves and which configuration files are used internally, but the web UI interaction is unchanged.
DNSSEC¶
DNSSEC validation was added to dnsmasq. When the DNS forwarder is enabled, DNSSEC-signed responses are validated before being returned to clients.
Wireless: WPA_Supplicant¶
WPA_Supplicant support was added. Prior to FreeBSD 11, WPA was not supported on WAN (wireless client mode). From FreeBSD 11 onward, wireless WAN connections can use WPA authentication.
Additional wireless driver support was also added:
- ath_pci for older Atheros PCI cards
- Ralink firmware (runfw) for RT2x00/RT3x00 USB adapters
VPN: StrongSwan removed¶
StrongSwan was removed. ipsec-tools (racoon + setkey) is the sole IPsec implementation. Any configuration or documentation referencing StrongSwan does not apply to FreeBSD 11 or later.
Sixxs IPv6 tunnel removed¶
The Sixxs IPv6-over-IPv4 tunnel service integration was removed following the Sixxs service shutdown.
FreeBSD 11 → FreeBSD 12¶
AES-NI built into kernel¶
AES hardware acceleration (AES-NI) moved from a dynamically loaded kernel module to a built-in kernel component. No configuration change required; the acceleration is always active on compatible hardware.
FreeBSD 12 → FreeBSD 15¶
Build system modernisation¶
- Source and ports fetching migrated from SVN to Git
- GCC 13 toolchain
- OpenSSL compatibility flags updated
pfmon fix¶
A PFLOG header offset fix was applied for FreeBSD 15 compatibility, ensuring firewall log capture via pfmon works correctly.
Fonts and icons¶
The web GUI received updated fonts (Noto Sans via CDN) and refreshed SVG icons.
Feature status in current release (FreeBSD 15)¶
| Feature | Status | Notes |
|---|---|---|
| Packet filter | pf | Migrated from IPFilter in FreeBSD 11 |
| DHCP server | dnsmasq | Migrated from ISC dhcpd in FreeBSD 10 |
| DHCP client (WAN) | dhcpcd | Migrated from dhclient in FreeBSD 11 |
| DNS forwarder | dnsmasq | With DNSSEC since FreeBSD 11 |
| IP Pools | pf tables | Added FreeBSD 10, reworked for pf in FreeBSD 11 |
| IPsec | ipsec-tools (racoon) | StrongSwan removed in FreeBSD 11 |
| L2TP/IPsec | ipsec-tools | Available |
| PPTP | mpd | Available (legacy) |
| Wireless WPA | WPA_Supplicant | Added FreeBSD 11 |
| AES-NI | Built-in kernel | Built-in since FreeBSD 12 |
| Traffic shaper | dummynet | Available across all branches |
| Captive portal | Available | No major changes across branches |
| VLANs | 802.1Q | Available across all branches |
| IPv6 | Available | DNSSEC+DHCP-PD improvements in FreeBSD 11 |
| Sixxs IPv6 tunnel | Removed | Removed in FreeBSD 11 |
| StrongSwan | Removed | Removed in FreeBSD 11 |