Please forgive me if this is old news.
- Restoring a configuration containing legacy firewall rules to an OPNsense instance 26.7
Importing a full configuration from a 26.4.1 instance with legacy firewall rules resulted in a 26.7 instance where the legacy rules showed up in the relevant interface sections and did seem to work, but the rules could not be selected, activated, deactivated, edited or deleted, as if they were automatic rules. Installing the rules-legacy plugin even before importing the config didn't help. The rules would show as legacy rules and as new style rules that couldn't be modified.
Another edit: If there are interface groups in the fw config, don't fiddle with the partial import feature. Just delete the whole "<filter>" section from the configuration xml file. This removes the rules but preserves the interface groups when importing.
My solution was to restart from scratch and perform a partial import with the firewall areas unchecked ( see footnote ), then export the legacy rules from the old firewall via migration assistant and import them in the new 26.7 instance.
In the legacy world, floating rules could only be edited in the floating rules tab. After migration, these rules can be edited while having selected any interface they apply to. So, while working on one interface one may change the semantics and scope of the rule for any and all other interfaces, including deletion. This may not be the end of the world, but I can sense trouble down the line because of this.
Expanding the automatic rules display while having selected all interfaces now produces a list of rules per interface. That would be a great tool to find out why 2 interfaces don't behave the same way, except the rules are all over the place because the list can't be ordered by interface, category or description. Sorting by interface doesn't change the processing order, so maybe this feature gets added.
Footnote: Partial config imports are pretty awkward to do since one has to check every area to import, carefully avoiding those you don't want. Moreover, if you check an area that isn't contained in the imported config file, you'll get an error message and you need to exclude them as well before you can retry. And of course, you have to reselect the config file. So please devs, make it a warning only, reserving error messages for show stoppers.
Everything is explained in migration wizard. You need to follow each step carefully. Once you complete the process as it is instructed, your rules will become editable and removable.
Quote from: Nullman on July 22, 2026, 04:34:12 PMEverything is explained in migration wizard.
Probably, except this isn't about migrating rules, it's about copying a configuration. This used to be a painless procedure in the past, but 26.7 poses new problems. Then again, I may be the last person in the world to still have instances of OPNsense with legacy rules. Then my first point doesn't apply. The other ones are still valid.