Can settings from ver OPNsense 21.7.8 be migrated to new version?

[seamus]

I installed OPNsense on my server in Jan 2018 - best I can recall. I upgraded fairly regularly until I got to ver 21.7.8. I stopped there because I was concerned about migrating to the "new" version, and because I began traveling extensively. My OPNsense firewall (OPNsense + SuperMicro Intel 4 core 1.8 GHz Atom CPU) has run 24x7 for many years now with virtually no maintenance or administration! The only time I even log into the FW is when I need to check the DHCP logs. My ISP is Google fiber - also very reliable. My family used the Internet continuously while I was on travel, and never had an incident. All this is background to say that I'm very pleased with this setup!

However, after 8+ years I have some concerns re my hardware. Late last year, I attempted installation of a newer version of OPNsense on a slightly newer server that has seen very little use - I planned to use it as a "cold backup" system. Unfortunately, my installation attempt was unsuccessful. 

I am now *seriously* considering the future. I definitely want to stick with OPNsense, but feel that I must upgrade my hardware. 8+ years ago I was "active", and enjoyed tinkering in such projects. Today, I'm looking for a solution that doesn't involve "starting over", and is less challenging for my aging brain  :P  All of that said, I have a few questions:

1. At one time (and perhaps still today) OPNsense allowed one to make a "configuration backup" to an XML file. I still have several of these backup files - several from 2022, the latest from June 2025. Can I apply these "backup configuration" files to a new version of OPNsense?

2. As I said earlier, I am motivated to upgrade my hardware. It's my understanding that if I bought a hardware server, OPNsense would come pre-installed. I wonder if I could send my "backup configuration" files to Decisio (?), and have them "pre-configure" my server?

3. As I read the specifications, it seems the DEC677 would meet my needs. My Google Fiber service is rated at 2 Gbps, and there are 3-4 fairly active users. We have a "streaming service" for movies, a "cellular extender box" and several (too many) computers laying about. Could someone "take a stab" at confirming the DEC677 would be sufficient?

That's all I can think of at present. Thanks in advance for your help!

Best Rgds,
~S

[tangofan]

I would doubt that Deciso will "preconfigure" a new device, unless it's done under a consulting agreement and I assume you're not willing to pay for that. But I might be wrong...

You have two problems:
1. You're about 10 major releases behind (assuming the 6 month release cycle has been going on since 2021) and
2. you also want to switch to a different hardware.

#2 means they even with a config file from the current version you may have to do some manual editing, because the network interfaces might have different names on your new hardware. That's the smaller problem by far.

#1 is the real problem: I seriously doubt that you can jump 10 releases ahead and expect everything to work, since nobody will ever test for that. It might work for a very simple setup, but I wouldn't bet on it. So you either upgrade manually through each release, carefully reading all the release notes for any breaking changes and/ or necessary manual steps, or alternatively just get a new device and start configuring it from scratch. For a simple setup, this might be the easier path.

Whatever you decide to do, in the future you should keep your router software more current. I don't see OPNsense (or any router/firewall software for that matter) as something you can leave unattended for months on end, let alone 5 years.

[lmoore]

You may be able to install OPNsense 22.1 on your back up machine as it's still available to download from the mirrors.

Take a current back up of your SuperMicro Atom and remove the tick for 'Do not backup RRD data.' before downloading the configuration.



Set up the back up machine on an isolated network to avoid IP address conflicts with the installation on the back up machine and especially when you've restored the configuration file.

You may be able to restore this configuration in to the OPNsense 22.1 installation. If there are differences with the interfaces, you will be prompted to resolve them.

If the restored configuration looks good, swap out the Atom with the back up machine and verify functionality.

If you are able to install updates, install the last of the 22.1 series, which is 22.1.10.

Go to System -> Firmware -> Status. If there are any plugin conflicts, press the button to resolve them.

Perform another configuration back up remembering to remove the tick so your RRD data is backed up too.

Review the update notes prior to each update and if necessary, make appropriate changes after the update.

Repeat the configuration backup prior to each major version upgrade.

I don't recall any unexpected behaviour when I updated my system to 26.1. However, when you get to 26.1.11 make sure you perform the firewall rules migration prior to upgrading to 26.7.

If you get to version 26.7 ensure you update your Boot Loader - Refer to https://forum.opnsense.org/index.php?msg=271899

HTH :).

[Edit] Add note to check for plugin conflicts.

[seamus]

Set up the back up machine on an isolated network to avoid IP address conflicts with the installation on the back up machine and especially when you've restored the configuration file.

Thanks for your reply! I have a couple of comments & questions if you don't mind, and I surely appreciate your time.

Re setting up on an "isolated network": To avoid confusion, let's agree to call my current, existing OPNsense ver 21.7.8 firewall as the "Primary" firewall, and a 2nd machine with the more current version of OPNsense we'll call the "Backup" firewall.

1. [QUESTION] I've only got a single network, and it's a fairly small one; my LAN is 192.168.1.0/255. I have about 20-30 hosts, and reserved approx 50 addresses for use as fixed IPs (using about 6 of those). My question is regarding the "isolated network". Could I simply connect the WAN for the "Backup" firewall to the LAN of the "Primary" firewall? IOW: connect the "Backup" WAN port into a switch used for LAN clients of the "Primary" firewall. And assign the "Backup" fw LAN to be (e.g.) 192.168.1.10/255? IOW the "Backup" firewall will be behind the "Primary" firewall? I could connect a couple of my Raspberry Pis to the "Primary" LAN to complete the "test configuration"...  Would this setup be what you characterized as an "isolated network"??  If there's a simpler/better method, please let me know. 


2. [COMMENT] After posting my question, I found a clear set of installation instructions for OPNsense. I successfully installed ver 26.7 on the "Backup" host machine. I used the shell to install/copy my latest backup config file into the "right place". Afterwards, I powered down the "Primary" firewall, and substituted the "Backup" firewall in its place to have a "look-see" at the GUI. To my surprise, most things worked! What didn't work was DHCP for all of the "dynamic" clients. I learned that ISC DHCP has been abandoned/deprecated by the ISC, and replaced with a new type of DHCP (KEA??). Anyway - I ran the network with the "Backup" firewall for about 20 minutes, and then restored the "Primary" firewall.

3. [QUESTION] Would the installation instructions I used for ver. 26.7 also work with older versions?

4. [QUESTION] Do you know what the last version number was for OPNsense that had the ISC DHCP as the default configuration?

Thanks again!
~S