4 ms·

Got any tips for the migration? I've been meaning to do it for a while, but I really need to limit down time or my wife and kids will bury me; preferably need t

Got any tips for the migration? I've been meaning to do it for a while, but I really need to limit down time or my wife and kids will bury me; preferably need to do it over an evening while they're all asleep. I only have the one piece of hardware so I need a record of the configs somehow to refer to as I do the migration. Perhaps also some sort of backup so I can restore it in a pinch if I can't get OPNSense set up quick enough.

LeoPanthera 3y ago
I'm afraid I did it the slow way, and just nuked the router and set up OPNSense from scratch. In older versions it was possible to import a PfSense backup - with a few glitches, but they're too different now. I think the slow way is the only way.
- alias_neo 3y ago
  That's kind of what I was expecting; but do you have any tips? Did you just do it from memory? I was thinking I'll screenshot the major config screens and interface layouts, my BGP configs etc, then work from them.
  - Brian-Puccio 3y ago
    Yes, screenshot things. But also export your config because you will inevitably forget to screenshot a thing or seven and you can poke around the config export for that port number or IP address. Worst case scenario, you can spin up a VM of pfsense quickly and reimport the config if you have to.
    - alias_neo 3y ago
      I have off-box backups of my configs. Thanks for the VM idea; sometimes I forget to use VMs to do things "embedded" devices usually do for me; switches, routers, etc! There's going to be a point soon where I have two fiber providers (and thus two WAN links) for a little while, I'll try move the existing pfSense off of my Protectli box to a VM, keep everything up for the family while I configure OPNSense on the Protectli, then if I do it right, I can move everything over with minimal reconfiguration.
deadfece 3y ago
When switching from pfsense to opnsense, I had to move everything to opnsense manually (and I do mean manually, not just updating terraform). It only took about 20 minutes to put things back on both members and have my tunnels up and going again, even counting my very specific customizations. It was anti-climactic and worked so well as to be boring, which is the absolute highest compliment that a replacement and cutover can have.
- alias_neo 3y ago
  Thanks for the info; I tried OPNSense originally but I had an issue with PPP on my old internet provider I never could get working so I switched to pfSense reluctantly and it just worked. I doubt I have anywhere near the networking knowledge you have, so some of the more complex things I have set up; like my BGP routes for my Kubernetes clusters and my VLANs/trunks etc, that have taken a lot of tinkering might take me quite some time. I expect the way they're configured will be different, terminology might be different, and of course the UI will be different, so I can't just do it by reference. I have no problem taking my time, so long as we have the basic networking we need for family and working from home.
  - deadfece 3y ago
    With regard to bgp, vlans, subinterfaces etc. Those things work the same way in opnsense. Most of my conversion was just data entry of the particulars. I try to keep my main fws as simple as I can, for the benefit of the household, but I do get carried away with home automation and IaC/CM to my firewalls.

LeoPanthera 3y ago

I'm afraid I did it the slow way, and just nuked the router and set up OPNSense from scratch. In older versions it was possible to import a PfSense backup - with a few glitches, but they're too different now. I think the slow way is the only way.

alias_neo 3y ago
That's kind of what I was expecting; but do you have any tips? Did you just do it from memory? I was thinking I'll screenshot the major config screens and interface layouts, my BGP configs etc, then work from them.
- Brian-Puccio 3y ago
  Yes, screenshot things. But also export your config because you will inevitably forget to screenshot a thing or seven and you can poke around the config export for that port number or IP address. Worst case scenario, you can spin up a VM of pfsense quickly and reimport the config if you have to.
  - alias_neo 3y ago
    I have off-box backups of my configs. Thanks for the VM idea; sometimes I forget to use VMs to do things "embedded" devices usually do for me; switches, routers, etc! There's going to be a point soon where I have two fiber providers (and thus two WAN links) for a little while, I'll try move the existing pfSense off of my Protectli box to a VM, keep everything up for the family while I configure OPNSense on the Protectli, then if I do it right, I can move everything over with minimal reconfiguration.

deadfece 3y ago

When switching from pfsense to opnsense, I had to move everything to opnsense manually (and I do mean manually, not just updating terraform). It only took about 20 minutes to put things back on both members and have my tunnels up and going again, even counting my very specific customizations. It was anti-climactic and worked so well as to be boring, which is the absolute highest compliment that a replacement and cutover can have.

alias_neo 3y ago
Thanks for the info; I tried OPNSense originally but I had an issue with PPP on my old internet provider I never could get working so I switched to pfSense reluctantly and it just worked. I doubt I have anywhere near the networking knowledge you have, so some of the more complex things I have set up; like my BGP routes for my Kubernetes clusters and my VLANs/trunks etc, that have taken a lot of tinkering might take me quite some time. I expect the way they're configured will be different, terminology might be different, and of course the UI will be different, so I can't just do it by reference. I have no problem taking my time, so long as we have the basic networking we need for family and working from home.
- deadfece 3y ago
  With regard to bgp, vlans, subinterfaces etc. Those things work the same way in opnsense. Most of my conversion was just data entry of the particulars. I try to keep my main fws as simple as I can, for the benefit of the household, but I do get carried away with home automation and IaC/CM to my firewalls.