[SOLVED] Migrating from pfSense

[dwasifar]

Is it possible to migrate from pfSense to OPNsense using a pfSense backup xml file?

[onefix]

Yes.  There are a few caveats regarding 3rd party packages (such as pfBlockerNG), but all of the settings that exist on a base install of pfSense should come over fine.

That having been said, OPNsense has a slightly different design philosophy than pfSense.  To clean up after my pfBlockerNG config, all I did was disable the aliases and firewall rules created by pfBlockerNG and remove the extra settings it added to the Unbound config.

If you're looking to duplicate pfBlockerNG, here is a good page on that.

http://www.routerperformance.net/opnsense/using-pfblocker-features-in-opnsense/

It will also open your eyes to the different design theories followed by OPNsense.

[3kj2w]

I was testing in VirtualBox importing config from pfsense 2.3.x:
- my problem was that if I imported all settings or only system section with users data-account-password I was unable to log in GUI, for some reason old passwords from pfsense 2.3.x did not work in opnsense 18.1.

To solve this problem I have to add original/default root user and password from a saved OPNsense config, then I can log and after that I can change passwords back for all imported users.

p.s.
Importing all settings seem to retain all old packages and data even are not used by OPNsense so I do not recommend.

suggestion:
will be nice to have option to select multiple sections at import list.

[franco]

The password was changed in an incompatible way: we still use the old style so that naturally breaks when trying to go backwards with a newer config. I would guess the other way around still works fine.


Cheers,
Franco

[dwasifar]

I finally got around to trying this.  As mentioned, I had to paste an OPNsense user into the pfSense config file to be able to log in afterwards, but on cursory examination it looks like everything else came over fine.

In case anyone is wondering why I'm switching, there are two reasons: 1) The opnsense.com story, and  2) AES-NI.  'Nuff said, I think.

[dwasifar]

Success!  OPNsense operating with very few tweaks needed.  Right now it's on an interim device (an old PC, actually) so I can watch it for a day or two before switching the actual production device (a Watchguard 515).

[bsiege]

Now, December 2018, every attempt to migrate from 2.2.4 to 18.7 via backup fails in early stages. Even with single parts like Interfaces, DHCP or Rulesets. Trying with spare APU. Sometimes even fully freeze after startup beep. Have many Rules, many dhcp fixed leases. Fully IPv4 and IPv6 usage. Multiple subnets. Three physical interfaces, one with 5 VLAN's. Im not complaining, but i think the differences are now too big. For me the effort to rebuild the configuration is too expensive. Maybe there is a way over API.

[mimugmail]

No, API wont do this. To be honest, if the system itself doesnt convince you to do the extra work setting up from scratch, you should stay with it every system has it's advantages

[franco]

It's been 4 years, for better or worse.


Cheers,
Franco