Can settings from ver OPNsense 21.7.8 be migrated to new version?

[seamus]

I installed OPNsense on my server in Jan 2018 - best I can recall. I upgraded fairly regularly until I got to ver 21.7.8. I stopped there because I was concerned about migrating to the "new" version, and because I began traveling extensively. My OPNsense firewall (OPNsense + SuperMicro Intel 4 core 1.8 GHz Atom CPU) has run 24x7 for many years now with virtually no maintenance or administration! The only time I even log into the FW is when I need to check the DHCP logs. My ISP is Google fiber - also very reliable. My family used the Internet continuously while I was on travel, and never had an incident. All this is background to say that I'm very pleased with this setup!

However, after 8+ years I have some concerns re my hardware. Late last year, I attempted installation of a newer version of OPNsense on a slightly newer server that has seen very little use - I planned to use it as a "cold backup" system. Unfortunately, my installation attempt was unsuccessful. 

I am now *seriously* considering the future. I definitely want to stick with OPNsense, but feel that I must upgrade my hardware. 8+ years ago I was "active", and enjoyed tinkering in such projects. Today, I'm looking for a solution that doesn't involve "starting over", and is less challenging for my aging brain  :P  All of that said, I have a few questions:

1. At one time (and perhaps still today) OPNsense allowed one to make a "configuration backup" to an XML file. I still have several of these backup files - several from 2022, the latest from June 2025. Can I apply these "backup configuration" files to a new version of OPNsense?

2. As I said earlier, I am motivated to upgrade my hardware. It's my understanding that if I bought a hardware server, OPNsense would come pre-installed. I wonder if I could send my "backup configuration" files to Decisio (?), and have them "pre-configure" my server?

3. As I read the specifications, it seems the DEC677 would meet my needs. My Google Fiber service is rated at 2 Gbps, and there are 3-4 fairly active users. We have a "streaming service" for movies, a "cellular extender box" and several (too many) computers laying about. Could someone "take a stab" at confirming the DEC677 would be sufficient?

That's all I can think of at present. Thanks in advance for your help!

Best Rgds,
~S

[tangofan]

I would doubt that Deciso will "preconfigure" a new device, unless it's done under a consulting agreement and I assume you're not willing to pay for that. But I might be wrong...

You have two problems:
1. You're about 10 major releases behind (assuming the 6 month release cycle has been going on since 2021) and
2. you also want to switch to a different hardware.

#2 means they even with a config file from the current version you may have to do some manual editing, because the network interfaces might have different names on your new hardware. That's the smaller problem by far.

#1 is the real problem: I seriously doubt that you can jump 10 releases ahead and expect everything to work, since nobody will ever test for that. It might work for a very simple setup, but I wouldn't bet on it. So you either upgrade manually through each release, carefully reading all the release notes for any breaking changes and/ or necessary manual steps, or alternatively just get a new device and start configuring it from scratch. For a simple setup, this might be the easier path.

Whatever you decide to do, in the future you should keep your router software more current. I don't see OPNsense (or any router/firewall software for that matter) as something you can leave unattended for months on end, let alone 5 years.

[lmoore]

You may be able to install OPNsense 22.1 on your back up machine as it's still available to download from the mirrors.

Take a current back up of your SuperMicro Atom and remove the tick for 'Do not backup RRD data.' before downloading the configuration.



Set up the back up machine on an isolated network to avoid IP address conflicts with the installation on the back up machine and especially when you've restored the configuration file.

You may be able to restore this configuration in to the OPNsense 22.1 installation. If there are differences with the interfaces, you will be prompted to resolve them.

If the restored configuration looks good, swap out the Atom with the back up machine and verify functionality.

If you are able to install updates, install the last of the 22.1 series, which is 22.1.10.

Go to System -> Firmware -> Status. If there are any plugin conflicts, press the button to resolve them.

Perform another configuration back up remembering to remove the tick so your RRD data is backed up too.

Review the update notes prior to each update and if necessary, make appropriate changes after the update.

Repeat the configuration backup prior to each major version upgrade.

I don't recall any unexpected behaviour when I updated my system to 26.1. However, when you get to 26.1.11 make sure you perform the firewall rules migration prior to upgrading to 26.7.

If you get to version 26.7 ensure you update your Boot Loader - Refer to https://forum.opnsense.org/index.php?msg=271899

HTH :).

[Edit] Add note to check for plugin conflicts.

[seamus]

Set up the back up machine on an isolated network to avoid IP address conflicts with the installation on the back up machine and especially when you've restored the configuration file.

Thanks for your reply! I have a couple of comments & questions if you don't mind, and I surely appreciate your time.

Re setting up on an "isolated network": To avoid confusion, let's agree to call my current, existing OPNsense ver 21.7.8 firewall as the "Primary" firewall, and a 2nd machine with the more current version of OPNsense we'll call the "Backup" firewall.

1. [QUESTION] I've only got a single network, and it's a fairly small one; my LAN is 192.168.1.0/255. I have about 20-30 hosts, and reserved approx 50 addresses for use as fixed IPs (using about 6 of those). My question is regarding the "isolated network". Could I simply connect the WAN for the "Backup" firewall to the LAN of the "Primary" firewall? IOW: connect the "Backup" WAN port into a switch used for LAN clients of the "Primary" firewall. And assign the "Backup" fw LAN to be (e.g.) 192.168.1.10/255? IOW the "Backup" firewall will be behind the "Primary" firewall? I could connect a couple of my Raspberry Pis to the "Primary" LAN to complete the "test configuration"...  Would this setup be what you characterized as an "isolated network"??  If there's a simpler/better method, please let me know. 


2. [COMMENT] After posting my question, I found a clear set of installation instructions for OPNsense. I successfully installed ver 26.7 on the "Backup" host machine. I used the shell to install/copy my latest backup config file into the "right place". Afterwards, I powered down the "Primary" firewall, and substituted the "Backup" firewall in its place to have a "look-see" at the GUI. To my surprise, most things worked! What didn't work was DHCP for all of the "dynamic" clients. I learned that ISC DHCP has been abandoned/deprecated by the ISC, and replaced with a new type of DHCP (KEA??). Anyway - I ran the network with the "Backup" firewall for about 20 minutes, and then restored the "Primary" firewall.

3. [QUESTION] Would the installation instructions I used for ver. 26.7 also work with older versions?

4. [QUESTION] Do you know what the last version number was for OPNsense that had the ISC DHCP as the default configuration?

Thanks again!
~S

[nero355]

Re setting up on an "isolated network": To avoid confusion, let's agree to call my current, existing OPNsense ver 21.7.8 firewall as the "Primary" firewall, and a 2nd machine with the more current version of OPNsense we'll call the "Backup" firewall.

1. [QUESTION] I've only got a single network, and it's a fairly small one; my LAN is 192.168.1.0/255. I have about 20-30 hosts, and reserved approx 50 addresses for use as fixed IPs (using about 6 of those).

My question is regarding the "isolated network".
Could I simply connect the WAN for the "Backup" firewall to the LAN of the "Primary" firewall?

Correct!

That's how I play with other Routers behind my own Router all the time :)

IOW: connect the "Backup" WAN port into a switch used for LAN clients of the "Primary" firewall.
And assign the "Backup" fw LAN to be (e.g.) 192.168.1.10/255? IOW the "Backup" firewall will be behind the "Primary" firewall?

It's /24 a.k.a. 255.255.255.0 ;)

The LAN subnet needs to be different than the one you are using now so pick something like :
192.168.2.0/24
192.168.10.0/24
10.0.0.0/24
172.16.1.0/24
172.31.1.0/24

Otherwise you will come back here complaining about not having Internet connectivity behind your Backup OPNsense ;)

I learned that ISC DHCP has been abandoned/deprecated by the ISC, and replaced with a new type of DHCP (KEA??).

DNSmasq is now the default choice.

ISC is still available as a plug-in but I don't recommend using it to be honest.

You can move the Static DHCP Mappings between ISC/KEA/DNSmasq via the Import/Export function which will give you nice .CSV files to play with and use as extra backup of the mappings ;)

3. [QUESTION] Would the installation instructions I used for ver. 26.7 also work with older versions?

IMHO it's all more or less the same, but you might need to adjust to some stuff not being straightforward... dunno...

4. [QUESTION] Do you know what the last version number was for OPNsense that had the ISC DHCP as the default configuration?

I think 25.x.x or 24.x.x should do the trick because I think I migrated to KEA before upgrading to 26.x.x to avoid the "moved to plug-in" change giving me any possible issues ;)

Thanks again!

Good luck!

[lmoore]

4. [QUESTION] Do you know what the last version number was for OPNsense that had the ISC DHCP as the default configuration?

25.1 and earlier.

3. [QUESTION] Would the installation instructions I used for ver. 26.7 also work with older versions?

Yes, this seems to be a standard installation.

2. [COMMENT] After posting my question, I found a clear set of installation instructions for OPNsense. I successfully installed ver 26.7 on the "Backup" host machine.

I'm still using the Legacy ISC DHCP server on 26.7 and I've not had to make any changes to keep it running after upgrading. I will migrate to Kea down the track.

1. [QUESTION] I've only got a single network, and it's a fairly small one; ...  Would this setup be what you characterized as an "isolated network"??  If there's a simpler/better method, please let me know.

No. You may be able to apply your configuration when installing from media on the Backup machine, which may ease the change. Refer to the OPNsense Importer documentation to import a configuration file at installation time - https://docs.opnsense.org/manual/install.html#opnsense-importer

Here are some suggestions:

Primary machine:

Perform a configuration back-up including RRD data.

Copy the configuration file to the conf directory on a USB stick per the OPNsense Importer instructions.

Backup machine:

Download and prepare installation media for OPNsense 25.1 or earlier.

Consider using ZFS for the file system as using Snapshots is easy.

Disconnect network cables.

Ensure BIOS is configured for UEFI mode.

Installation Choices - YMMV

Boot the installation image and follow the steps;

 1) listed under For new installations or migrations, follow this process: in https://docs.opnsense.org/manual/install.html#opnsense-importer and then log in as installer to commit it to the Hard Drive.

 2) performed using https://opnsenselab.com/posts/opnsense-initial-setup-guide/



Substitute machines and test.

I'll iterate:

• Resolve plugin conflicts using the latest update of the first installed version of OPNsense, e.g. 25.1.12.
• Repeat the configuration back-up prior to each major version upgrade.
• When you get to 26.1.11, make sure you perform the firewall rules migration prior to upgrading to 26.7.
• If you get to version 26.7, ensure you update your Boot Loader - Refer to https://forum.opnsense.org/index.php?msg=271899

HTH - I think you're getting there.

[seamus]

Trying to set up

Set up the back up machine on an isolated network to avoid IP address conflicts with the installation on the back up machine and especially when you've restored the configuration file.

I've hit a snag in setting up the "isolated network":

• The WAN on the "Backup" fw seems to be fine. It was set up for DHCP, and when I plug it into the "Primary" fw (switch connected to LAN port), it takes an IP address of 192.168.1.139... that seems OK
• The LAN is not cooperating! The config.xml file I restored to the "Backup" fw has the LAN setup as 192.168.1.1/24. To fix this, I'm using Option 2 in the CLI/console setup menu. During the Option 2 dialog, I changed the LAN IP to 192.168.10.1/24. Unfortunately this change DOES NOT TAKE! Each time I finish with Option 2, the system reports the LAN address as 192.168.1.1/24!!

What am I doing wrong? Do I have to edit the XML file to make this change to the LAN address range? Why doesn't Option 2 allow me to make this change?

Thanks again,
~S

[lmoore]

I've hit a snag in setting up the "isolated network"

You have a DHCP server running in OPNsense on your LAN port, so you can't simply change the LAN IP address from the console whilst the DHCP server is running.

Isolated Netowrk:

Code Select Expand

        +-------------------+                       +-------------------+
        |     PC with       |                   LAN |     Backup        |
        |  Ethernet port    |<--------------------->|     OPNsense      |
        |  IP set manually  |    Ethernet Cable     |     Firewall      |
        | 192.168.1.254/24  |                       |  192.168.1.1/24   |
        | unless DHCP is    |                       |                   |
        |    working        |                       |                   |
        +-------------------+                       +-------------------+

I don't understand why you plugged the WAN port in to your functioning LAN - it wasn't going to work. That's why I advised disconnecting network cables.

What happened when you substituted the machines after restoring the configuration?

Working with the Backup machine and your PC, which are isolated from the rest of your network, plug a network cable into the Backup machine's LAN port and plug the other end into your PC's Ethernet port.

If you don't receive an IP address after a couple of minutes, manually configure TCP/IP on the PC and assign an unused IP address on your 192.168.1.0/24 network, such as 192.168.1.254/24, set the gateway and DNS server addresses to 192.168.1.1 .

If you are you able to ping 192.168.1.1 you should be able to access the Web GUI too.

If you have access to the Web GUI, plug your WAN cable from the Primary machine in to the WAN port of the Backup machine.

Let me know what is and isn't working at this point.

What are the interface names for LAN & WAN?