Making a copy of my installation

bingo600

With one of these "sums"

Memstick - Serial
SHA256 Checksum for compressed (.gz) file:
9ce90667f39f837df88e936aa0fd478c2aee8f96a8b8d54d13431a921e877cac

Memstick - VGA
SHA256 Checksum for compressed (.gz) file:
aa40595d090465f20fff1890092e6a14a753cd9486ccc7101d81301cad8b8840

And for the "OS Impaired" , that doesn't have sha256sum

certutil -hashfile <pfSense-install-file-name>  SHA256

Example

certutil -hashfile pfSense-CE-memstick-2.4.5-RELEASE-p1-amd64.img.gz SHA256
SHA256 hash of pfSense-CE-memstick-2.4.5-RELEASE-p1-amd64.img.gz:
aa40595d090465f20fff1890092e6a14a753cd9486ccc7101d81301cad8b8840
CertUtil: -hashfile command completed successfully.

Balanga

@gertjan said in Making a copy of my installation:

@balanga said in Making a copy of my installation:

pfSense-CE-2.4.4-RELEASE-p3-amd64

Make that 2.4.5-p1.

I didn't find a copy of that on my LAN. Installed what I had and tried to an upgrade from the console but got an error about packages for wrong OS version. With this version I couldn't even get DHCP working and have been unable to access files on my network. I'm thing of installing ISC-DHCP on one of my FreeBSD systems just to get up and runnng.

bingo600

@balanga
Remember to go to System --> Updates and select the "old deprecated"
Else you might get 2.5.x packages

skogs

Of note when restoring a config, especially to a different piece of hardware, you may need to use the console to manually reassign the interfaces. When hardware changes, or even on new hardware, sometimes they'll reinitialize in an order that isn't what the config is expecting.

Balanga

Once I have pfSense copied and a file with all the settings, I still need to install all the pkgs. Can I get a list and download them all? I guess pkg info should tell me what has been installed...

Also, I guess I need to copy all the files which tftpd provides access to.

Have I forgotten anything?

skogs

System - Package manager menu item will show you the packages installed. You can't download them ahead of time, it is just that ~sometimes the auto install fails when you shove in the config first.

Balanga

@skogs

So I have created a backup copy of pfSense, but AFAICS, to make it a copy of my working installation I still need to copy any existing packages and their configurations, my current settings and a copy of my tftp files.

As far as my tftp files go, can I simply logon to the pfSense box and mount the backup system and copy the tftp directory structure?

Also could I copy my settings like this as well?

skogs

Yeah the documented upgrade and backup procedures are pretty good: https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html

Takes you through the whole thing...backup....removing packages...etc.

The mounting word concerns me...you're not mounting anything. The backup is a big fat xml file with all the settings. It just downloads to your desktop or wherever.

Obviously if you've got a ton of boot images or something else critical on tftp, copying the files themselves off is a necessity.

The restore is pretty easy. Get the machine up from a blank state, click through the setup webpages quick, load the packages, then shove in the config file. Reboots, then poof you're all set generally; just re-upload the tfpt stuff after.

mpetts1

Sorry to jump in here. We are in a similar situation. The hardware that our current install (2.4.0) is running on is failing. We have a new unit to use. We have succesfully installed 2.5.1 which was downloaded from the website and restored our current configuration. Unfortunately our current configuration does not work on the new version - i.e. internet access works but none of the NAT/Firewall rules work? All interfaces have been re-assigned correctly. I'm guessing a number of things have changed between releases - is there anything that I should check taking the above into account?

Thanks
MP

Gertjan

@mpetts1 said in Making a copy of my installation:

works but none of the NAT/Firewall rules work?

Hard to see - meditate I should.
They show up under the correct interfaces ?

@mpetts1 said in Making a copy of my installation:

current install (2.4.0)

This is what I would consider a close to perfect way to make sure that "upgrading" produces issues.

The config file is very readable.
It's very big because you also included the RRD stats into it.

Most settings can be clearly read, and checked with the GUI "on screen" settings.

@mpetts1 said in Making a copy of my installation:

none of the NAT rules work

The new pfSense has the same WAN "RFC 1918" IP as before
AND
is there a router in front of pfSense ?

If so, double check the WAN IP - as the upstream router still forwards to the IP used by the old pfSense. If the new pfSense install has another WAN IP, all is fine, it's totally normal NAT doesn't work.
Change your WAN IP by using a DHCP MAC Lease on the upstream router, or make your WAN IP settings static, so they correspond with the old setup.

mpetts1

Thank you for getting back to me so quickly @Gertjan

@gertjan said in Making a copy of my installation:

@mpetts1 said in Making a copy of my installation:

works but none of the NAT/Firewall rules work?

Hard to see - meditate I should.
They show up under the correct interfaces ?

Yes interfaces all appear to be OK. The first thing it said when it booted up after the restore was that the interfaces didn't exist and i needed to map the correct ports.

@mpetts1 said in Making a copy of my installation:

current install (2.4.0)

This is what I would consider a close to perfect way to make sure that "upgrading" produces issues.

The config file is very readable.
It's very big because you also included the RRD stats into it.

Most settings can be clearly read, and checked with the GUI "on screen" settings.

Unfortunately I didn't really have a choice as I cannot find the same version anywhere! Netgate won't supply me with it as it isn't supported anymore.

@mpetts1 said in Making a copy of my installation:

none of the NAT rules work

The new pfSense has the same WAN "RFC 1918" IP as before
AND
is there a router in front of pfSense ?

If so, double check the WAN IP - as the upstream router still forwards to the IP used by the old pfSense. If the new pfSense install has another WAN IP, all is fine, it's totally normal NAT doesn't work.
Change your WAN IP by using a DHCP MAC Lease on the upstream router, or make your WAN IP settings static, so they correspond with the old setup.

Everything looks correct - the ip is correct. There is a router infront of pfSense. We were able to access the internet etc. but the NAT and Rules didn't work. Perhaps a reboot would of worked? I didn't have a huge amount of time so plugged the old one back in.

mpetts1

@mpetts1 @gertjan

Solved this in the end. Removed the WAN Gateway and re-added. Same info as before, just works this time! Thank you for your help.