how to recover using an old configuration?

[nero355]

It sucks that we can't automatically store the config on an ftp server or send it by email at least once daily when it has been changed.  If that were possible I would have set that up and I'd have the current config now.

Wrong statement: There are several plugins that provide configuration backup service. I personally use 'os-sftp-backup' and works perfectly. You even have 'os-git-backup', so you can trace every single modification in a git server.

[TL:DR] Do no blame others for your own lazyness/lack of knowledge.

Apart from that, you should always make a backup before any upgrade, so your last config would be on the last-1 version. Plus you should also take a snapshot, assuming your system uses zfs, which it's the recommended.

Make a backup before and after you make important changes. It can also help to find which change was wrong by just making a 'diff' between them.
Gonna play with firewall rules? Have a backup before just in case you even get to lose connectivity with the machine. It will take almost no time to go back.

If you follow those well-known basic advices, you won't have any problem recovering from even the total disaster. Of course, everyone is free to not make regular backups, snapshots before upgrades, or any prevention measure at all, but must be conscious of the risk it implies and don't cry if/when sh*it hits the fan.

Last but not least, being polite with the people usually gets best results when asking for help.

AMEN! :)

It's soo easy to Export all sorts of Configuration Backups in OPNsense these days that it's a real shame not to use them!

- Configuration itself : config.xml
- Static DHCP Mappings : .CSV file
- Firewall Rules : .CSV file
- NAT Rules : .CSV file

Just to name a couple of big ones :)

[defaultuserfoo]

No. It's not working.

Instead it was made to appear something easy to do.  But it is isn't.

This reminds of the fatal blow Debian struck their users with their stupid brokenarch.  I had been using Debian for about 15 years and then the devs decided to comepletely mess it up, and it was forseeable that the problems would continue to exist in the next release.  So I switched away from Debian.

This is the same crap.  If I knew a good alternative to OPNsense I would switch.

As someone who is using both Debian and OPNsense I totally disagree with you :)

That's up to you.  You probably weren't using Debian when they created the problem.

We've already had a discussion about the release notes.  The devs refuse to make good release notes.

NOFI but IMHO it's you and not the software...

Maybe try something OpenWRT based or simply buy stuff like TP-Link Omada or Ubiquiti UniFi or HPE Aruba ?!

I don't know about OpenWRT.  TP-Link is fine for simple stuff like unmanaged switches.  Anything that requires firmware more advanced than that you can only stay away from.  Ubiquity totally sucks; they can't even write documentation.  Aruba makes nice switches and access points, and I have an HP router that comes with outstanding documentation which I took out of service because it's too loud.  Apparently they have put Aruba stickers on their routers.  Maybe those would be an option, but they might be expensive.  Do they do wireguard now?

[Kinerg]

You could have posted at least a screenshot of the supposedly messed up rules after migration.

"It doesn't work" is not very helpful.

[defaultuserfoo]

It means that all the rules need to be redone because migrating them doesn't work

It seems you are in the minority of users experiencing the impossibility of migrating firewall and NAT rules.

Perhaps you could invest time working through your issue and find a way to restore your old configuration file and get it working in a way where information already provided has not worked.

Considering the pain this has caused you, and in the interest that another user may some day befall your predicament, you could document the process you used and post it to the list, so they may also benefit from your experience.

The router is currently working again with 25.7.11 and an old configuration (from February) that needed only minor adjustments.  In a while, I'll use the spare machine to create a copy and to figure out if the rules can be converted.  Maybe I can document what happens then.

[defaultuserfoo]

You could have posted at least a screenshot of the supposedly messed up rules after migration.

"It doesn't work" is not very helpful.

I'm not sure if it's a good idea to publish the firewall rules for everyone to see.  And unless you would know excatly in detail what the current rules are supposed to do, you won't be able to tell if the so-called migration was successful.  The only way to know for sure would be to try them in production.

[defaultuserfoo]

It sucks that we can't automatically store the config on an ftp server or send it by email at least once daily when it has been changed.  If that were possible I would have set that up and I'd have the current config now.

Wrong statement: There are several plugins that provide configuration backup service. I personally use 'os-sftp-backup' and works perfectly. You even have 'os-git-backup', so you can trace every single modification in a git server.

I'm not aware of such plugins.  System: Configuration: Backups doesn't mention anything in that regard.

Maybe put a hint onto that page: "More backup options may be provided by plugins you can install."

[TL:DR] Do no blame others for your own lazyness/lack of knowledge.

That doesn't have anything to do with lazyness.  If a useful option had been there like it should, I'd have used it.  Of course I can't know everything.

Apart from that, you should always make a backup before any upgrade, so your last config would be on the last-1 version. Plus you should also take a snapshot, assuming your system uses zfs, which it's the recommended.

No, the backup is either from before the router was updated last time or from the last time before the configuration was changed, that's why the latest backups were from August last year and from February this year.  When the storage has become unbootable, having a snapshot isn't very helpful.  Updating wasn't the issue at all anyway.

Make a backup before and after you make important changes. It can also help to find which change was wrong by just making a 'diff' between them.

That's why I have the backup from February.

Gonna play with firewall rules? Have a backup before just in case you even get to lose connectivity with the machine. It will take almost no time to go back.

No, when the connection is gone, it's gone and I have to drive there to fix it.

If you follow those well-known basic advices, you won't have any problem recovering from even the total disaster. Of course, everyone is free to not make regular backups, snapshots before upgrades, or any prevention measure at all, but must be conscious of the risk it implies and don't cry if/when sh*it hits the fan.

Recovering from a disaster is one thing; unexpectedly being forced to do the so-called migration of firewall rules is another thing.  I was told here that it'll take many years before the so-called migration is required.  Don't blame me for being given wrong information and not being happy about that.

Last but not least, being polite with the people usually gets best results when asking for help.

I adjust to the politeness and situation I encounter.  When you feed people wrong information and let them find out the hard way, and when you handle crucial changes like the so-called firewall rule migration in such a bad way, and when you show a bad attitude by expecting everyone to always know everything, you can't be surprised when people are totally pissed off and may not be as polite as they otherwise might be.

Other than that, I'm grateful for the help I'm getting here.

[Patrick M. Hausen]

I was told here that it'll take many years before the so-called migration is required

Yes - you can install the legacy rules plugin on 26.7 and continue to use the old UI and the old rules. I don't know how many years exactly are implied here, though.

[nero355]

That's up to you.  You probably weren't using Debian when they created the problem.

My point is :

There is no problem.

Not in Debian and not in OPNsense.

I don't know about OpenWRT.

Then research it :)

TP-Link is fine for simple stuff like unmanaged switches.
Anything that requires firmware more advanced than that you can only stay away from.

Almost bought one the other day and still might do it in the future : Nothing wrong with their products IMHO...

Ubiquityi totally sucks; they can't even write documentation.

I have other issues with them, but if you can live with those then they are fine too.
In Wall Accesspoints are AWESOME!!! :)

Aruba makes nice switches and access points, and I have an HP router that comes with outstanding documentation which I took out of service because it's too loud.  Apparently they have put Aruba stickers on their routers.  Maybe those would be an option, but they might be expensive.
Do they do wireguard now?

Another thing to research ;)

I'm not aware of such plugins.  System: Configuration: Backups doesn't mention anything in that regard.

Maybe put a hint onto that page: "More backup options may be provided by plugins you can install."

The world is already dumbing down soo much...

Let's not go that far in OPNsense : Mmmkay ?!

Of course I can't know everything.

But you can research your options...

No, when the connection is gone, it's gone and I have to drive there to fix it.

Then you need some kind of OOB device or IPMI/iDRAC/iLO for your OPNsense in such cases :)

Recovering from a disaster is one thing; unexpectedly being forced to do the so-called migration of firewall rules is another thing.
I was told here that it'll take many years before the so-called migration is required.

You keep saying that, but I think you have mixed things up with ISC which will be useable for some years to come, but eventually needs to be migrated to DNSmasq/KEA before it completely disappears!

Other than that, I'm grateful for the help I'm getting here.

You are welcome! :)