3 ms·

> One major advantage of virtualizing the firewall in this way is the ability to take snapshots. Not only do we get fast VM reboots after a firmware upgrade, I

> One major advantage of virtualizing the firewall in this way is the ability to take snapshots. Not only do we get fast VM reboots after a firmware upgrade, I'm kinda skeptical, unless I'm missing something. How much time does it take for a VM host to reboot and resume firewall guest vs reboot firewall on metal?

InvaderFizz 4y ago
I have a virtualized openwrt router for some VPN functions. Full boot of the guest OS to routing traffic over the WireGuard tunnel is under 10 seconds from the time I hit reboot. Edit: I see you were referring to the host boot times plus the VM boot times, which I am not and neither is the article.
- tedunangst 4y ago
  What firmware are we updating that does not require a host reboot?
  - lmz 4y ago
    "Firmware" as in "router OS image" I guess.
zamadatix 4y ago
I think there is a terminology divide here. OPNsense being more an "appliance" type solution calls the system software firmware, a bit like Android. It's not firmware in the traditional sense like updating motherboard firmware. In that context the quote is about rebooting the firewall VM after an OPNsense update not about rebooting the host.
- tedunangst 4y ago
  I think I considered that possibility, then rejected it due to the incongruence of firmware and VM guest.
  - justsomehnguy 4y ago
    https://docs.opnsense.org/manual/updates.html https://docs.opnsense.org/manual/updates.html > Installing updates > Updates can be installed from the web interface, by going to System ‣ Firmware ‣ Updates. On this page, you can click Check for updates to search for updates. If they are available, a button will appear to install them.
justsomehnguy 4y ago
Time to reboot the host and power-up the VM. Usually the time to pause the guest (ie halt it and dump memory to the disk) and resume exceeds standard shutdown/startup times. Though in this case I think they treat a router OS update as a firmware. I didn't saw a Linux based OS on a hardware for a long time, but at least in VMs current distros start up pretty fast, while *BSD based VMs take a little more time to init, though everything start in less than a minute.

InvaderFizz 4y ago

I have a virtualized openwrt router for some VPN functions. Full boot of the guest OS to routing traffic over the WireGuard tunnel is under 10 seconds from the time I hit reboot. Edit: I see you were referring to the host boot times plus the VM boot times, which I am not and neither is the article.

tedunangst 4y ago
What firmware are we updating that does not require a host reboot?
- lmz 4y ago
  "Firmware" as in "router OS image" I guess.

zamadatix 4y ago

I think there is a terminology divide here. OPNsense being more an "appliance" type solution calls the system software firmware, a bit like Android. It's not firmware in the traditional sense like updating motherboard firmware. In that context the quote is about rebooting the firewall VM after an OPNsense update not about rebooting the host.

tedunangst 4y ago
I think I considered that possibility, then rejected it due to the incongruence of firmware and VM guest.
- justsomehnguy 4y ago
  https://docs.opnsense.org/manual/updates.html https://docs.opnsense.org/manual/updates.html > Installing updates > Updates can be installed from the web interface, by going to System ‣ Firmware ‣ Updates. On this page, you can click Check for updates to search for updates. If they are available, a button will appear to install them.

justsomehnguy 4y ago

Time to reboot the host and power-up the VM. Usually the time to pause the guest (ie halt it and dump memory to the disk) and resume exceeds standard shutdown/startup times. Though in this case I think they treat a router OS update as a firmware. I didn't saw a Linux based OS on a hardware for a long time, but at least in VMs current distros start up pretty fast, while *BSD based VMs take a little more time to init, though everything start in less than a minute.