pfSense » pfSense Packages

Summary

After upgrading one pfSense CE firewall from 2.7.2 to 2.8.1 in a three-site OpenVPN TLS + FRR
OSPF topology, OSPF adjacencies remained FULL and LSDB synchronization succeeded, but one
learned OSPF route was not installed into the FreeBSD kernel routing table.

Environment

Three pfSense CE firewalls interconnected using OpenVPN TLS site-to-site tunnels with FRR
OSPF Area 0.0.0.0. Only one firewall was upgraded to 2.8.1; the other two remained on 2.7.2.

Observed Behavior

- OpenVPN tunnels remained UP.
- OSPF neighbors reached FULL state.
- LSDB synchronized successfully.
- show ip route showed the remote route learned via OSPF.
- netstat rn did NOT contain the affected route.
- route n get followed the default WAN route instead of the VPN.
- Traceroute exited through the Internet.

Diagnostic Evidence

The route 172.168.50.0/24 was known by OSPF but absent from the kernel routing table.
Adding the route manually with:
route add -net 172.168.50.0/24 50.0.10.2
immediately restored connectivity.
Adding the same route as a static FRR route:
ip route 172.168.50.0/24 50.0.10.2
resulted in successful kernel installation (K>* entry) and restored connectivity.

Expected Result

Routes learned via OSPF should automatically be installed into the kernel routing table by Zebra.
Actual Result
OSPF learns the route correctly, but the route is not automatically installed into the kernel until
added manually as a static route.

Conclusion

This report documents the observed behavior. The evidence suggests a problem in the automatic
installation of an OSPF-learned route into the kernel after upgrading one node to pfSense CE 2.8.1.
Additional screenshots, command outputs and configuration files will be attached separately to the
issue.