Upgrade OPNsense Firmware Without a Maintenance Window

Keeping firewalls current is one of those tasks that is easy to describe and painful to execute. Every device in the fleet needs the same package updates, and the safest way to deliver them has always required a maintenance window — schedule the downtime, log into each box, run the upgrade, reboot, verify. Multiply that by a dozen sites and a weekend disappears.

Today that changes. NetDefense can now upgrade OPNsense firmware directly from the platform, and the most important part of this feature is not the upgrade itself — it is the ability to apply most of the upgrade without any downtime, separating the reboot-free application packages from the base and kernel so your firewalls stay current without a maintenance window.

Two modes, one command

Firmware upgrades are issued as a run command with a required --mode flag:

minor upgrades within the current OPNsense series. A device on 26.1.2 can reach 26.1.9; it stays on the 26.1 branch. This is the everyday maintenance path.

major jumps across series boundaries — 25.1 → 25.7, 25.7 → 26.1. It always applies the full package set and always reboots. Use it for planned cycle upgrades.

The differentiator: upgrading without downtime

The minor mode accepts a --no-reboot flag. When you use it, the platform applies only the packages that do not require a reboot — application-layer packages and plugins. Base and kernel are not installed; they stay at the current version until you run the command again with a reboot.

Because those reboot-free packages are swapped out while the firewall is live, there is zero traffic interruption. The task completes and the device keeps running. The product_version does not advance yet — that happens once a subsequent run applies base and kernel with a reboot.

After this runs, the device is in what we call a mixed state: application packages are at the new version, base and kernel are still at the previous one. The device functions normally. The firmware status on the device detail page shows Update pending reboot until a full upgrade run (with reboot) completes it.

Completing the upgrade

The no-reboot run is the first half. The second half is a standard minor upgrade — without --no-reboot — scheduled for a convenient window:

That run installs base and kernel, reboots the device, and the version advances. The mixed state clears. This is the key insight: the costly part — the downtime — is isolated to one short reboot window, while everything else was already applied days or weeks earlier without any interruption.

Preview before you commit

Every firmware-upgrade command accepts --dry-run. This creates a task that runs a preview on the device — nothing is installed. Once the task completes, fetch the result:

Scheduling — the automation story

The feature integrates directly with named schedules. The combination unlocks a maintenance strategy that requires no manual intervention once it’s configured.

A typical layered approach uses three schedules:

What this does:

• Daily at 3 AM UTC — minor upgrade, no-reboot. Application packages are always current. Zero downtime.
• First of each month at 4 AM UTC — minor upgrade with reboot. Completes the upgrade: installs base and kernel, advances the version, clears the mixed state.
• January 1 and July 1 at 5 AM UTC — major upgrade. Series jump on a predictable six-month cycle.

Once these three commands run, the platform manages the entire firmware lifecycle for your fleet. You can see the scheduled tasks at any time:

Available everywhere

Firmware upgrades are available across all NetDefense interfaces:

• NDCLI — ndcli run firmware-upgrade with the full flag set shown above.
• NDWeb — the Run page includes Firmware Upgrade as a command. Select the mode, configure the reboot option, pick your targets, and run immediately or attach a schedule.
• MCP server — available as an MCP tool for AI-assisted workflows.

Getting started

Run your first upgrade today:

Full documentation, including the complete flag reference and scheduling examples, is in the Firmware Upgrades guide.

Firmware upgrades are available now — upgrade to ndcli v1.16.0 to get the command (brew upgrade ndcli, or follow the NDCLI getting started guide for other installation methods).