View source for PfSense CE → pfSense Plus Upgrade Guide

= pfSense CE → pfSense Plus Upgrade Guide =

'''Reference Video:''' [https://www.youtube.com/watch?v=Fa1NAuWDzjs Comparing pfSense Plus & pfSense CE: Cost and Key Differences Explained]

'''Official Netgate Migration Guide:''' [https://docs.netgate.com/pfsense/en/latest/install/migrate-to-plus.html Migrate from pfSense CE to pfSense Plus]

This guide consolidates the full set of steps and best practices for upgrading a system from '''pfSense Community Edition (CE)''' to '''pfSense Plus'''.

----

== Differences Between pfSense CE and pfSense Plus ==

=== 1. Cost & Licensing ===
* '''pfSense CE:''' Completely free, community-supported.
* '''pfSense Plus:''' Free for '''home''' and '''lab''' use. Automatic entitlement when used on Netgate hardware; CE → Plus migration requires registration but remains free.

=== 2. Support Model ===
* '''CE:''' Community forums only.
* '''Plus:''' Eligible for paid Netgate TAC support.

=== 3. Base System & Release Cadence ===
* Both share the same FreeBSD base (FreeBSD 14 as of 2023).
* '''Plus''' receives '''more frequent releases''' and hotfixes.
* '''CE''' has a '''longer release cycle'''.

=== 4. Features Exclusive to pfSense Plus ===

{| class="wikitable"
|-
! Feature
! CE
! Plus
|-
| Boot Environments (automatic snapshots)
| ❌
| ✔️
|-
| QAT Crypto Acceleration
| ❌
| ✔️
|-
| OpenVPN DCO (Data Channel Offload – Beta)
| ❌
| ✔️
|-
| OpenVPN Client Import Tool
| ❌
| ✔️
|-
| AWS VPN Wizard
| ❌
| ✔️
|-
| IPsec Export for Apple Profiles
| ❌
| ✔️
|-
| IPsec Export for Windows PowerShell
| ❌
| ✔️
|}

=== 5. Features Fully Available on Both ===
Both versions support: High Availability (CARP), VLANs, OpenVPN, WireGuard, IPSec, L2TP, ZFS file system, and all major routing & firewall features.

=== 6. ZFS & Boot Environments Clarification ===
* '''Both''' CE and Plus support ZFS.
* '''Only Plus''' includes the Boot Environment GUI tools + auto-snapshot during upgrades.
* CE requires more manual ZFS handling.

=== 7. Security Patch Handling ===
* Plus receives '''faster updates''' to the base OS when needed.
* CE updates are slower but still maintained and not considered unsafe.

----

== 1. Before You Begin ==

=== A. Confirm Requirements ===
* A Netgate account with an activated pfSense+ subscription or device entitlement.
* Your pfSense CE must be '''2.6 or later'''.
* Internet connectivity for the upgrade process.

=== B. Prepare Backups ===
* Go to '''Diagnostics → Backup/Restore'''.
* Download the latest full configuration backup.
* If virtualized: take a VM snapshot.
* If physical: prepare a USB installer for pfSense+ (failsafe recovery option).

=== C. Review Boot Environments ===
* pfSense CE/Plus uses ZFS Boot Environments.
* Each upgrade automatically creates a new boot environment (snapshot).
* You may manually create one via: '''System → Boot Environments → Create'''.

----

== 2. Clean Up Before Upgrading ==

=== A. Evaluate Installed Packages ===
Netgate best practice:
* '''Uninstall all third-party packages''' before upgrade.
* When uninstalling, choose '''"Keep configuration files"'''.
** This allows you to reinstall packages after the upgrade with your settings intact.

If you decide to upgrade with packages installed:
* Do this '''only if you understand the risks'''.
* Some packages may break the upgrade or behave unpredictably.

----

== 3. Enable Upgrade to pfSense Plus ==

=== A. Purchase, Receive Token, and Prepare for Migration ===

==== 1. Purchase the Correct Subscription ====
* Go to the '''Netgate Store'''.
* Choose '''pfSense+ Software Subscription with TAC Lite Support''' (or the appropriate plan).
* In the dropdown, select: '''Upgrade from pfSense CE to pfSense Plus'''
** ''(Do NOT leave it on Renewal/New Install.)''
* Add to cart and complete checkout.

After purchase, '''Netgate will email the activation token''' to the email address on the store account.

{{Note|If the token email does not arrive quickly, check spam/junk folders. Tokens are '''single-use''' — ensure the CE system is stable and in its intended configuration before proceeding.}}

=== B. Register pfSense CE Using the Token ===
# In the pfSense CE GUI, navigate to '''System → Register'''.
# Paste the activation token.
# Click '''Register'''.
# Confirm registration success on the page.

=== C. Switch to the pfSense Plus Upgrade Branch ===
# Go to '''System → Update'''.
# The page should now announce availability of the pfSense Plus migration branch.
# Set '''Branch''' to: '''pfSense Plus Upgrade'''
# Wait for the update check to finish.

=== D. Begin the Migration Upgrade ===
* Click '''Confirm''' to start the migration.
* This will convert CE → Plus as part of the upgrade process.

=== E. Switch Update Branch (Post-Migration) ===
# Go to '''System → Update'''.
# Click the '''Update Settings''' tab.
# Change '''Branch''' to: '''Current Stable Version (Plus 25.07 or newer)'''.

=== F. Verify Licensing ===
If your CE system is not yet entitled for pfSense+:
* Go to '''System → Registration'''.
* Log in using your Netgate account.
* Attach device to your subscription.

----

== 4. Perform the Upgrade ==

=== A. Start the Upgrade ===
# Go to '''System → Update'''.
# Click the '''Cloud icon''' to retrieve latest metadata.
# Wait for system to check installed version vs available version.
# When the upgrade path appears (example: ''24.11 → 25.07''), click '''Confirm Update'''.

=== B. DO NOT Leave the Page ===
* Keep the browser tab '''open and running''' during the entire upgrade process — do not close, refresh, or navigate away.
* If possible, monitor via the physical console.

=== C. Automatic Reboot ===
* System will download packages, verify signatures, create a new boot environment, apply updates, then reboot.
* During reboot: do '''not''' power off or reset.
* Expect '''long startup times''' — sometimes several minutes. The system is applying updates and rebuilding components. '''Do not assume it is stuck; give it plenty of time.'''

The browser will auto-refresh and reconnect when the web GUI is back.

----

== 5. Post-Upgrade Validation ==

=== A. Log In and Verify Version ===
* Dashboard should show: '''pfSense Plus 25.07.xx''' (or newer).

=== B. Verify Package Compatibility ===
# Go to '''System → Package Manager'''.
# Click '''Available Updates'''.
# Ensure all installed packages are updated.

=== C. Check for Hotfix Patches ===
# Go to '''System → Patches'''.
# Confirm that no new patches are required.

----

== 6. Restore Packages (If You Uninstalled Them Earlier) ==

# Go to '''System → Package Manager → Available Packages'''.
# Reinstall packages one by one.
# Your previous configurations should auto-apply.

----

== 7. Rollback (If Something Breaks) ==

=== Option A: Restore Boot Environment ===
# Reboot pfSense.
# From bootloader menu choose '''Boot Environments'''.
# Select the older (pre-upgrade) environment.

=== Option B: Reinstall Using Online Installer ===
# Boot from USB installer.
# Choose '''Recover Configuration from URL'''.
# Upload or paste your backup file.

----

== Comfac-IT Internal Note (Licensing for Clients) ==

Some Comfac-IT clients prefer to purchase '''pfSense Plus licenses''' through us. When we buy from the Netgate Shop, we receive the '''activation tokens''', and we are responsible for their issuance and tracking.

'''Internal workflow:'''
* Schedule a '''calendar reminder''' exactly '''1 month before token expiration'''.
* Coordinate with the client early to ensure tokens are used on time.

{| class="wikitable"
|-
! Item
! Amount
|-
| Token cost from Netgate
| PHP 7,740
|-
| Comfac-IT selling price
| PHP 8,000
|-
| Margin
| PHP 260
|}

These amounts are small, so efficiency and proper scheduling are critical.

----

== 8. Final Recommendations ==

=== A. Maintain Good Upgrade Hygiene ===
* Always backup before upgrading.
* Always keep a recovery USB.
* Only upgrade when you have a recovery window (off-hours).

=== B. Best for Production ===
* Physical hardware for stable routing.
* Virtualization for labs and home setups.

=== C. Verify Logs ===
* Check '''Status → System Logs → General / Package / Boot''' for anomalies.