Reviewing pfSense Plus 25.07 – A Practical Look Before 25.11 Arrives

Netgate released pfSense Plus 25.07 back in August, but as with all firewall and network infrastructure updates, it’s rarely wise to deploy on day one. In a production environment, stability and predictability matter far more than early adoption.

Now that the release has had a few months to settle, and with pfSense Plus 25.11 Beta Release beginning to circulate, this is the point where I typically start reviewing the current stable version and planning upgrades for client systems.

In my latest video, I walk through the official release notes for pfSense Plus 25.07, highlight the most important changes, and discuss whether upgrading now makes sense depending on your environment.

You can watch the full video breakdown here:
👉 

What’s new in pfSense Plus 25.07?

This release brought a number of meaningful improvements. Some of the most notable include:

• Netgate Nexus: the first appearance of a centralised, multi-instance management platform for pfSense Plus devices.

• Auto Config Backup improvements: a cleaner, more reliable implementation for secure, cloud-hosted configuration backups.

• Kea DHCPv6 and Prefix Delegation: part of the ongoing shift towards a more modern DHCP backend.

• Optional new PPPoE backend (if_pppoe): a kernel-level PPPoE implementation designed to eventually replace the legacy MPD-based PPPoE service.

• NAT64 / DNS64 support: enabling IPv6-only networks to reach IPv4 resources without additional translation hardware.

• A variety of security fixes, WebGUI updates, and general performance improvements.

It’s not a flashy release, but it is a solid one, and often, that’s exactly what you want from a firewall platform.

Why review it now?

pfSense’s update behaviour means many users won’t actually see 25.07 offered much longer. Once 25.11 becomes the current stable branch, pfSense will offer an upgrade directly to that version, skipping intermediate builds entirely.

That’s perfectly normal, and all fixes introduced in 25.07 are included in later versions.
However, for anyone responsible for maintaining business networks, it’s still useful to understand what changed in 25.07, how it behaves in practice, and whether your current configuration is ready for the transition to 25.11.

Should you upgrade now?

As always, the answer depends on your risk profile:

• If your environment prioritises stability and you prefer to avoid early-cycle updates, 25.07 is mature, stable, and safe to deploy.

• If you prefer to minimise the number of change windows, you may wish to wait for 25.11 to reach general release.

• In either case, take a backup first, review the release notes, and test the upgrade on non-production hardware if possible.

pfSense Plus 25.07 hasn’t introduced any disruptive changes in my testing, and it serves as a solid foundation for organisations preparing for the next major update.

Final thoughts

25.07 is one of those releases that quietly strengthens the platform rather than trying to reinvent it. With 25.11 on the horizon, now is a good time to review your existing pfSense deployment, catch up on stable updates, and ensure your configuration is in a good state before the next upgrade cycle.

pfSense and Netgate are registered trademarks of Rubicon Communications, LLC. This article is not affiliated with or endorsed by Netgate.