When to migrate to new firewall rules?

[mlenje]

I just read that the 26.7 release is planned for July 15. Does that mean we need to migrate firewall rules before then?

[OzziGoblin]

I've been worry about this as well, but since the upgrade to 26.1.11 my new rules are populated without my having done anything, is this by design, did I miss something again when ready the release notes? :-)

thanks

[Monviech (Cedrik)]

The new rules are populated with old rules read only, they still only exist in the old rules.

Old rules have a distinct command button that opens the legacy rule page, and cannot be deleted/cloned in the new GUI

You still have to migrate eventually.

In 26.7 the old rules will be turned into a plugin, so they will still work. No pressure to migrate yet.

[hharry]

I recently took the plunge, and used the rules migration assistant tool, the UI was a little clunky, but it worked, and the migrated rules to new format are all working as intended...i've since deleted all the old legacy format rules...

[nero355]

In 26.7 the old rules will be turned into a plugin, so they will still work. No pressure to migrate yet.

I don't like depending on stuff that's moved to a plug-in so I guess it's time to migrate before the 26.7 upgrade :)

I did the same with ISC and moved to KEA before the 26.x upgrade to avoid plug-in weirdness that some people eventually had who did not follow the same plan as I did so I was very happy with my choice!

And it looks like I might have to do the same with the Outbound NAT to Source NAT migration according to the 26.1.11 Release Notes so it's going to be very interesting the next couple of weeks :P

[tigo003]

Just did the migration of the rules and nat rules. It was a matter of exporting & importing them using the migration assistant, then a review audit of the rules - along with testing connectivity to be as expected. Indeed all worked correctly. I had tried this a few months ago, and it was bad experience that I just reverted to the backup, and in an earlier forum chat, I concluded that I'd leave this till December / January. But now that it's done, things will hopefully be smoother moving forward with the upgrades, and any changes.

[plgvie]

Took the plunge yesterday, two sites with all precautions (backup and snapshot) been taken care of. Firewall rules and Outbound/Source NAT transition worked out just fine - the migration assistant did his job very well.

[mlenje]

I migrated the rules this morning, and the process was surprisingly easy.  I took screenshots of all my exiting rules beforehand, followed the migration assistant making snapshot and downloading the configuration.  It went smoothly.  I was stressed for nothing!

[beneix]

Old rules have a distinct command button that opens the legacy rule page, and cannot be deleted/cloned in the new GUI

You still have to migrate eventually.

In 26.7 the old rules will be turned into a plugin, so they will still work. No pressure to migrate yet.

I have not yet taken the plunge to migrate. Today, I went to my rules for the first time in years and was going to edit one of my rules because I need to add a failover 5G gateway as my fibre broke this morning. To my surprise, all my rules seem to be read-only – the only command button is the button that takes me to the migration instructions, there is no edit button. Is this to be expected – that in order to make changes to my rules I have to migrate?

Incidentally, I am using Firefox but tried the same page in Chrome as well.

[Patrick M. Hausen]

Install the os-firewall-legacy plugin to continue to use the old UI. Migrate at your convenience, then uninstall the plugin.

[beneix]

Thanks @Patrick. Since my OPNsense router has no connectivity, I need to perform an offline install of the plugin. Is this the correct plugin?

https://pkg.opnsense.org/FreeBSD:15:amd64/26.7/latest/All/os-firewall-legacy-1.1.pkg

[Monviech (Cedrik)]

https://pkg.opnsense.org/

Choose the ABI you need (FreeBSD 14 for business 26.4.x)

/snapshots/latest/Latest/os-firewall-legacy.pkg

[beneix]

Thanks Cedrik. I have opened a new thread under 26.7, since that is what I am running and the topic has changed.