Troubleshooting “Failed” pfSense+ Upgrades on Netgate Hardware

Posted on by Thiago Crepaldi

Last Updated on April 4, 2026 by Thiago Crepaldi

The Disk Space Wall

Updating your firewall is usually a “set it and forget it” task, but if you’re running a high-performance appliance like the Netgate 6100, you might occasionally hit a wall. In my case, I triggered the update from 25.x to 26.03, the logs start rolling, and then—Failed.

If your logs mention cloning boot environments followed by a space requirement (e.g., “The process will require 98 MiB more space” – or similar), you’ve run into a storage bottleneck. Here is how to clear the path and get your upgrade finished.

Why is this happening?

Most Netgate appliances, like the 6100, use ZFS (Zettabyte File System). ZFS is incredible because it creates Boot Environments (BE). Before an upgrade starts, pfSense clones your current working system. If the upgrade fails, you can simply roll back to the clone.

However, these clones—combined with log files, package caches, and IDS databases—can eventually fill up the 16GB eMMC storage found in many base-model appliances.

Step 1: Purge Old Boot Environments

This is the most common fix. Every time you update, a “snapshot” of your old OS is saved. If you’ve updated three or four times without cleaning these, they are eating up your disk.

  1. Navigate to System > Boot Environments.
  2. Look at the list. You will see one marked Active and On Reboot.
  3. Delete the others. (Keep the “default” one if it’s your current active one, but remove old “Auto” clones from previous months).

Step 2: Flush the Package Cache

When an upgrade fails midway, the system might have already downloaded hundreds of megabytes of .pkg files that are now just sitting in a temporary folder.

  1. Go to Diagnostics > Command Prompt.
  2. Execute the following command:Bashpkg clean -a
  3. This safely wipes the download cache without touching your installed software.

Step 3: Check the “Data Hogs” (Suricata, Snort, ntopng)

If you run heavy monitoring packages, your /var partition might be full of logs or flow data.

  • ntopng: Go to the ntopng settings and clear historical data.
  • IDS/IPS: Check Services > Suricata (or Snort) > Logs View and clear out old alerts.
  • System Logs: Go to Status > System Logs > Settings and click Reset Log Files.

Step 4: Use the Console for the Upgrade

The WebGUI is great, but it can sometimes timeout during large disk operations. For a more “bulletproof” upgrade experience:

  1. Connect to your Netgate 6100 via SSH or the USB Console port.
  2. In the pfSense menu, select Option 13 (Update from Console).
  3. This provides real-time feedback and is less likely to hang if the system is busy re-organizing ZFS snapshots.

The Permanent Solution: NVMe Expansion

The Netgate 6100 is a powerhouse, but the onboard 16GB eMMC is its “lite” storage option. If you find yourself doing this dance every six months, consider taking advantage of the M.2 NVMe slot inside the case.

Installing a standard 128GB or 250GB NVMe drive will effectively end your disk space worries forever, allowing you to keep dozens of boot environments and massive log files without a second thought.

Summary: If your upgrade fails, don’t panic and don’t factory reset. Just clear your Boot Environments, flush your package cache, and try the update again via the console.

Have you upgraded your Netgate storage, or are you sticking with the onboard eMMC?

Leave a Reply