[Tutorial] Building OPNsense virtual machine images

[Maurice]

There are (at least) three ways to set up an OPNsense VM:

• Install from scratch using an installer image,
• use a preinstalled FreeBSD VM image and convert it to OPNsense using opnsense-bootstrap,
• build a preinstalled VM image using the OPNsense tools.

I've always preferred the last method and recently streamlined and documented my workflow:

https://github.com/maurice-w/opnsense-vm-images/blob/master/README.md

Thanks a lot to Franco for patiently explaining some of the more obscure build steps!

Cheers
Maurice

[Patrick M. Hausen]

Fourth way:

git clone ...
vagrant up

https://github.com/punktDe/vagrant-opnsense

[Maurice]

Yep, appreciate all your work there! It has specific requirements though (VirtualBox, Vagrant, amd64, UFS only, ...) and is intended primarily for development. Correct me if I'm wrong.

My goal was to provide instructions which work for many (production) environments. I have OPNsense instances running on-prem on Hyper-V (amd64), in the cloud on QEMU (amd64 + aarch64) and I'm exploring other options as well.

Cheers
Maurice

[Patrick M. Hausen]

For production I don't see a problem with performing a manual installation from distribution iso/img. OPNsense installs in less than five minutes. Depending on your infrastructure (e.g. vSphere) you can create a template from the finished installation with a couple of clicks.

Yes, my small project is not intended for production use, because it uses a desktop hypervisor.

Kind regards,
Patrick

[Maurice]

5 minutes is optimistic, more like 10 in my experience. And 30 times 10 minutes is five hours. ;) I just prefer to have a collection of up-to-date VM images in the drawer which can be used to spin up a VM in literally seconds.

Also, an interactive installation can be a real pita in cloud environments, which sometimes don't even have a proper video and / or serial console. Yes, you can create templates from interactively installed VMs, but these have other disadvantages (like not automatically growing the root partition and file system after expanding the image).

For aarch64, I'm not even aware of an interactive installation method. opnsense-bootstrap isn't supported either.

I'm not trying to convince anyone that any particular method is best. I've used all three extensively over the past six years, and that's what works best for me. By far. Other methods might work better for others, absolutely.

Cheers
Maurice

[Patrick M. Hausen]

Seriously, what's your use case for aarch64?

[Maurice]

Good value for money cloud VMs. All the big players now offer very competitive ARM instances. I'm aware OPNsense-aarch64 is not yet officially supported, but it already works quite well.