General feedback

[talespin]

Hi OPNSense team,

Just want to share my feedback.

I was on a very old version (1 year back) of OPNSense and wanted to move to 26.7. I had to update firmware a number of times, it went through multiple subversions example
25.1, 25.3, 25.7, 26.1, 26.7

Update firmware should require single click to bring it to latest version without needing to go through older versions.

[notspam]

Sorry, this is a totally wrong head line.
Nothing you wrote is a general feedback.
It is the specific question of not understanding the update path.
One year behind ? Absolutelly unusal use case.

[meyergru]

@talespin: Or you should update more often to keep up with patches for known vulnerabilities, like most people do. That way, you will only have to do small. incremental steps in case something changes w/r to functionality. This is the reason why you cannot expect an automatic mechanism that spans more than one version in one big leap.

There is also the possibility to backup your configuration, install fresh and import your configuration. However, that may fail for the same reason.

[franco]

I think you'll dismiss at least 3 things:

1. These update points are fixed and vetted.  Asking for forward compatibility from 25.1 with e.g. 27.1 is nice, but requires a time machine or keeping 25.1 up to date which is just not what we (want to) do.

2. Use a recent image for faster upgrades.

3. Migration notes accumulate in such scenarios.


Cheers,
Franco

[notspam]

opnsense-update -bkp

gives the possibilities to fine graduated updates


basic system (-b)
kernel (-k)
packets/plugins (-p)

Not updating a firewall system for a year is really unusal.

[pfry]

[...]1. These update points are fixed and vetted.[...]

While I would characterize that as a choice, the nature of OPNsense (constant evolution with limited functional abstraction) makes an arbitrary upgrade step impractical. So a somewhat inevitable choice.

I've fallen behind on updates myself, so I plan to work up a new config on fresh install on a second machine... before a fresh install on a third machine which will replace the first, on which I will then perform a fresh install and keep as a backup. It's worth it to me to avoid stress and potential downtime; YMMV.