Totally confused by migration assistant

[lignumaqua]

Updated to 26.7. All working fine, thank you.

However I'm confused by the Migration Assistant. This is what I see in the menu:



(Posted an image here but it doesn't show up for some reason, here's the url: https://shottr.cc/s/1B0N/SCR-20260717-fmu.png )

There is only a 'Rules' entry, not a 'Rules(new)'. Does this mean that I already did the migration (which I might have done in a prior release, but forgotten)? If I have done it why is the Migration Assistant still saying I haven't? However, if I haven't run the migration, then how do I do it without the 'Rules (new)' option?

[nero355]

If you have not migrated then you need to do it after installing the 'Firewall Rules - Legacy webGUI plug-in' first !!

Read the 'Release Changes Log' carefully next time! ;)

/EDIT :
I messed up a little...
See : https://forum.opnsense.org/index.php?msg=270874

[lignumaqua]

Thanks for the reply. I am definitely guilty of not reading through all the RC notes. :-) I only read the 26.7 release notes which don't seem to mention it at all. Now I dig back through the RC notes this is what I found:

"The static PHP pages for firewall rule management have been moved to the "os-firewall-legacy" plugin that can be optionally installed. Note that the upgrade will not install it as rules will continue to work and are easily migrated using the given assistant."

The phrase, "easily migrated using the given assistant" and the fact that the plugin isn't automatically installed suggests to me that the migration assistant will just work without it. I'm still confused! If the plug-in is necessary for the migration assistant to run, then shouldn't it either install it, or at least include text in the instructions to tell you to do so? Otherwise why show the Migration Assistant in the menu at all if it isn't going to work?

Perhaps I did already migrate the rules and have forgotten (I've slept since 26.1). Is there a way to tell if the rules are migrated or not?

[Monviech (Cedrik)]

To complete the migration you only have to follow all steps outlined in the Migration Assistant, including deleting all old rules with the last button.

Then it vanishes.

You dont need the os-firewall plugin.

You can see all old rules in the rules screen but they are not editable until after you completed the migration.

[nero355]

To complete the migration you only have to follow all steps outlined in the Migration Assistant, including deleting all old rules with the last button.

Then it vanishes.

You dont need the os-firewall plugin.

I thought the deletion of the old rules needed to be done from the old webGUI, but now that you mention it : Indeed, the Migration Wizard does that for you as the last step!

My bad! :)

[lignumaqua]

Thank you both, that does indeed do the trick. It seemed non-intuitive to import rules into a table which apparently already had all those rules. I was expecting to be importing them into a new, empty, table. Not one that was already populated with the exact same rules.

I'm sure all this is very clear if you've worked through the betas, but the 'old' rules appearing in the new interface with no indication that they are the old rules, not the new, and need to be migrated is IMHO weird! :-)

Can I humbly suggest that this is still really confusing for those of us who didn't follow the process through the RCs? The images shown in the forum show the Rules (new) and Rules menu entries, which apparently don't appear now. It was also disconcerting that all the rules show up twice for a while and you don't know which are the old and which the new. Maybe the old rules should all have a colored background both before and after they are migrated? Something that makes it clear which is which?

In contrast the NAT migration was very clear as it moved rules from one place to another, not to the same place again.

Anyway - all done now and the migration Assistant has disappeared. Thanks again for the help.

[lignumaqua]

PS - It would be nice if the rules export actually created and saved a file rather than just opening a web page that you have to cut and paste yourself. If you'll forgive me, this seems half done.

[franco]

PS - It would be nice if the rules export actually created and saved a file rather than just opening a web page that you have to cut and paste yourself. If you'll forgive me, this seems half done.

This seems like a browser specfic quirk. I've never seen it.

In general: people always and for many years asked for more visibility with automatic rules. Added visibility is great and now there's legacy awareness in the new rules pages, but then the other half gets confused by how this works. It's the circle of (development) life.


Cheers,
Franco

[dseven]

PS - It would be nice if the rules export actually created and saved a file rather than just opening a web page that you have to cut and paste yourself. If you'll forgive me, this seems half done.

It should produce a CSV file. What your browser decides to do with that is another matter. Generally it would ask you to save it somewhere. If your browser is displaying the contents, maybe you could right-click it and "Save as..." ?

[franco]

Could also be some sort of browser plugin or anti-virus interfering.


Cheers,
Franco

[nero355]

PS - It would be nice if the rules export actually created and saved a file rather than just opening a web page that you have to cut and paste yourself. If you'll forgive me, this seems half done.

My bet is on this part of the browser settings : https://www.idownloadblog.com/2020/11/12/default-apps-actions-open-file-firefox/

I always change all of them to "Always ask" to counter unwanted actions from websites :)

Can I humbly suggest that this is still really confusing for those of us who didn't follow the process through the RCs?

I guess you missed all the information and discussion topics during the 26.1.x releases and basically the fact that you should have migrated before upgrading to 26.7.x to make sure this kind of stuff doesn't happen ;)

[lignumaqua]

I'm using Safari on a Mac and apparently, unlike Chrome and Firefox, it is default behavior to display CSV rather than save it as a file. Maybe add to the instructions that it is a CSV file and to right-click and select save file?

Comments that I should have read all the discussion topics are somewhat elitist and not really helpful. I'm a regular user, not a power user, and only visit these forums to ask questions and seek solutions. I'm sure you have a lot of users like me! I'll also say that comments I did read from earlier versions said that there was no hurry to migrate, so I didn't.

Rather than blaming me for not reading pages and pages of forum posts, can I suggest a more positive approach:

1. Adding some more detail to the Migrate instructions as to what you will see.
2. As I mentioned before, make it clear in the table which are old and which are new rules. Colored background would work.

[nero355]

Comments that I should have read all the discussion topics are somewhat elitist and not really helpful. I'm a regular user, not a power user, and only visit these forums to ask questions and seek solutions. I'm sure you have a lot of users like me! I'll also say that comments I did read from earlier versions said that there was no hurry to migrate, so I didn't.

Rather than blaming me for not reading pages and pages of forum posts

It was more meant as a 'Just saying...' comment or 'FYI : ... ' if you will and with 0,0 elitist or blaming or whatever intentions :)