Backup from Virtual Appliance / Restore on Hardware Appliance

[0zzy]

Hello folks,

My OPNSense installation has been running for 4 weeks (thanks to the German people of this forum).

I have decided to purchase a hardware appliance from Protectli next week.

The question for me is how difficult it is to backup and restore the settings from my virtual appliance (on Promox) to the new appliance.

Also (and yes, I've read many times on this forum that reinstalling OPNSense is easy, but I'd like to make it more automated, but more on that later).

So my question is: how do you transfer your backups?

For me, my time is a very limited resource, so I think about automatisms.

But first I need as much input as possible from all my colleagues here. It doesn't matter how you install the appliance (directly on the hardware or virtually).

Now I just need to know how you do it.

And the plan from my side is to automate this (I haven't decided what kind of code yet).


I look forward to any response from you and thank you in advance.

BR 0zzy

[cookiemonster]

In my opinion you have to consider two parts. Then look at your specifics.
A. The "standard" configuration which is a single file.
B. The other customisations or additions that are not in that file.
Knowing that then you can start thinking how. Here the specifics.
- Do you want to use the raw device from proxmox to create an installation on baremetal. Want/can use DD.
- Do you have an UEFI installation in Proxmox, then you need to consider that for baremetal (two partitions).

Short version is that if you don't have customisations outside what gets recorded in the config file, then an install of OS and restore of config is the easiest way.

[Maurice]

Export the config, install OPNsense on the new hardware, import the config during installation, assign the interfaces, done.

Optionally, you can manually edit the interface assignments in the XML before importing it.

Cheers
Maurice

[cookiemonster]

Doesn't account for customisations like includes for plugins, does it?

[Maurice]

Correct. Everything that can be configured via GUI or API is stored in the config.xml.
If you add any custom files, these need to be backed up and restored separately.

[0zzy]

@cookiemonster to all of your questions:

1.) at the moment I installed without UEFI, on the new Hardware (protectli) I never used it before, so I can't really say if this is using UEFI by default (I want to bought the coreboot BIOS, also I never used it before),
2.) the hard disk under proxmox is a qcow2 with ssd emulation,

@cookiemonster and @Maurice
3.) is it so really so easy? My problem is, that I'm really new in OPNSense (I used pfsense for testing but for my playground it wasn't enough to fit my play instinct ), so everything I need is:

a) install opnsense,
b) check the backup config (xml isn't a problem for me),
c) change the config for my needs,
question to c):
if I have configured some tunables in my Virtual Appliance, I need to remove them and add them to fit the hardware of the protectli right?
d) plugins aren't too hard, they're of course needed but I don't think that they may work (especially acme-client and the certificates in that) so it's not a big problem.


Hm, sounds it would be easier to push that OPNSense image I have virtually directly to the protectli via dd or similar.

I would check this and also the xml part.

Does any of you guys know, how the image for OPNSense is created? Are there any Documentation for this?
Eventually it would be possible to make a running installation file out of the running VM?

[Maurice]

Tunables are included in the config.xml backup. If you have any which are specific to your hypervisor, you should remove them (or just hit the "Default" button on the tunables page).

The ACME client configuration is also included in the backup, but the certificates themselves aren't. So you have to trigger a re-issue on the new machine. This will also create new private keys. If this should be an issue for your use case, you'd have to backup & restore the ACME client directory manually.

I wouldn't bother with a full image backup / restore. Just perform a fresh install. The interactive installer allows you to import the config.xml during installation, e.g. from a flash drive.

[cookiemonster]

sounds like a straight forward case and will work as Maurice says.
I like completeness hence I mentioned other customisations that don't come across on a config.xml and best knowing beforehand.