General feedback

[talespin]

Hi OPNSense team,

Just want to share my feedback.

I was on a very old version (1 year back) of OPNSense and wanted to move to 26.7. I had to update firmware a number of times, it went through multiple subversions example
25.1, 25.3, 25.7, 26.1, 26.7

Update firmware should require single click to bring it to latest version without needing to go through older versions.

[notspam]

Sorry, this is a totally wrong head line.
Nothing you wrote is a general feedback.
It is the specific question of not understanding the update path.
One year behind ? Absolutelly unusal use case.

[meyergru]

@talespin: Or you should update more often to keep up with patches for known vulnerabilities, like most people do. That way, you will only have to do small. incremental steps in case something changes w/r to functionality. This is the reason why you cannot expect an automatic mechanism that spans more than one version in one big leap.

There is also the possibility to backup your configuration, install fresh and import your configuration. However, that may fail for the same reason.

[franco]

I think you'll dismiss at least 3 things:

1. These update points are fixed and vetted.  Asking for forward compatibility from 25.1 with e.g. 27.1 is nice, but requires a time machine or keeping 25.1 up to date which is just not what we (want to) do.

2. Use a recent image for faster upgrades.

3. Migration notes accumulate in such scenarios.


Cheers,
Franco

[notspam]

opnsense-update -bkp

gives the possibilities to fine graduated updates


basic system (-b)
kernel (-k)
packets/plugins (-p)

Not updating a firewall system for a year is really unusal.

[pfry]

[...]1. These update points are fixed and vetted.[...]

While I would characterize that as a choice, the nature of OPNsense (constant evolution with limited functional abstraction) makes an arbitrary upgrade step impractical. So a somewhat inevitable choice.

I've fallen behind on updates myself, so I plan to work up a new config on fresh install on a second machine... before a fresh install on a third machine which will replace the first, on which I will then perform a fresh install and keep as a backup. It's worth it to me to avoid stress and potential downtime; YMMV.

[franco]

opnsense-update -bkp

gives the possibilities to fine graduated updates


basic system (-b)
kernel (-k)
packets/plugins (-p)

Not updating a firewall system for a year is really unusal.

If you want to try that... fine... but DO NOT report issues with this.  As I said: it is unvetted and potentially incompatible across multiple major versions.

[franco]

While I would characterize that as a choice [...]

It is, but basically couples with the FreeBSD release approach for their minors, too.  There isn't much nuance to this other than making a completely different release model (and still trying to retrofit FreeBSD underneath).

A lot of today's security scope evolves around EoL software management and with an LTS you're either Red-Hatting backports to everything or make multiple major breaks for third party software despite the LTS claim of the distribution.  In both cases more technical debt accumulates compared to a rolling release model.


Cheers,
Franco

[notspam]

Good to know that this possibility is not officially supported. Used from time to time in case of problems with the three areas conflicting while updating.

opnsense-update -bkp

gives the possibilities to fine graduated updates


basic system (-b)
kernel (-k)
packets/plugins (-p)

Not updating a firewall system for a year is really unusal.

If you want to try that... fine... but DO NOT report issues with this.  As I said: it is unvetted and potentially incompatible across multiple major versions.

[Netlearn]

I was about one or two months ago, I was somehow curious about upgrades resilience.

I downloaded the oldest OPNsense image available (maybe 20.X or 22.X or so) and installed it in a virtual machine. Configured the basics and started upgrading up to the most recent version (some on the 26.X.X).

The process was completely flawless. Impressive.

When upgrading, it goes to the last version of the current release, then upgrade to the next and so on. It took some time but told me about the solid the system is the long term (upgrades related).

It looks to me that devs have been doing a great job regarding long-term resilience. Kudos!!