How do you handle drive failures in OPNsense?

[BigFreddy]

Hi everyone,

I was recently thinking about drive storage and how it is used in OPNsense, how often the drives should be changed and how much data OPNsense writes to it which I don't have a clear answer on. What comes with this topic is drive storage failures and my question is how do you guys handle that part of the firewall?

What's your philosophy or approach to drives used in OPNsense? Do you monitor drives for failures, if so, how and if not, how do you make sure that the failure of the drive doesn't cause any issues or opens up the firewall on the WAN side upon the failure?

Let's discuss about this topic and everything that comes with it.
Thanks

[Patrick M. Hausen]

Do you monitor drives for failures, if so, how

I use Scrutiny - and I am a bit disappointed I got zero feedback for my detailed instructions which I wrote up here:

https://forum.opnsense.org/index.php?topic=48101.msg242617#msg242617

I'd recommend to do something like this for every installation. Similar to watching temperatures e.g. via SNMP.

how do you make sure that the failure of the drive doesn't cause any issues or opens up the firewall on the WAN side upon the failure?

That scenario is so unlikely I would call it impossible. The firewall rules are loaded into the kernel. The default rule without any rule present is "deny all". So with all user processes crashing but the kernel just continuing to forward packets, your policy does not change. And should the firewall reboot but not be able to configure itself because it cannot read the configuration from the drive, all doors are shut.

[Mpegger]

I think for the home, if you're not making constant changes and tend to just "set it and forget it", just having a backup of the configuration and a recent ISO of OPNsense is enough to mitigate any sudden drive loss. A 2 disk mirror is also an option if you can swap drives when one suddenly dies.

[Seimus]

I lately started to use Beszel, which is slowly replacing my needs for the Grafana stack.
The last update added as well ZFS pool monitoring.

It works on every platform even OPN(FBSD), Proxmox PVE, LXCs etc.
So I have one uniform pane of view for metrics.

Beszel has as well a PR open for a possibility to monitor a device via SNMP, when that happens I can as well put it into my mikrotik switch.

Regards,
S.

[Patrick M. Hausen]

I lately started to use Beszel, which is slowly replacing my needs for the Grafana stack.

Interesting. Thanks!

[Seimus]

You are welcome,

Its really nice, and seamless to integrate. Basically I have all my LCXs, and whole network (expect mikrotik) in there.

Pic Of OPNsense ZFS pool monitoring.


Regards,
S.

[BigFreddy]

You are welcome,

Its really nice, and seamless to integrate. Basically I have all my LCXs, and whole network (expect mikrotik) in there.

Pic Of OPNsense ZFS pool monitoring.


Regards,
S.

This looks quite useful, mind sharing any links or insights how you setup and built the dashboard? I presume that dashboard is hosted on a spare device with some sort of agent installed on OPNsense?

[Patrick M. Hausen]

The dashboard is preconfigured. Yes, it also needs a separate Linux/Docker device. And an agent on OPNsense.

Start here:

https://www.beszel.dev/