An OPNsense configuration backup is one small XML file that contains your entire network — every rule, mapping and setting. And OPNsense updates arrive often, which is good news that punishes people who click them unprepared. These two routines, done together, turn disasters into ten-minute inconveniences.
Everything you build in OPNsense lives in one configuration file. That is a gift: back it up and you can rebuild on fresh hardware almost exactly. It is also a responsibility: lose it, and you rebuild from memory. This guide covers the backup routine (download, store, automate, test-restore) and the update routine (backup first, read, apply, verify), including the honest part — what to do on the rare day an update misbehaves.
Go to System → Configuration → Backups and download the configuration. That XML file is complete: interfaces, rules, DHCP, DNS, VPN, users, certificates. Store it in at least two places off the firewall — a folder on your PC and a cloud drive or NAS. Plugins exist to automate this to Google Drive or Nextcloud; they are convenience, not a substitute for having done it manually once and knowing where the file is. Take a fresh backup after every meaningful change, and always before an update.
A backup is a promise; a restore is the proof. At least once, practise: on the same box after a config download, or better, in a spare VM, use the restore option on the same Backups page and confirm the system comes back with your rules and mappings intact. Note the one wrinkle — restoring onto different hardware can require reassigning interfaces, because the new box's network ports have different names. That is a two-minute console job when you know it exists, and a panic when you do not.
OPNsense publishes two major releases a year with regular smaller updates in between — a firewall that updates often is a firewall whose holes get closed, so do not fear the cadence; systemise it. The routine: read the release notes briefly, download a configuration backup, apply the update from System → Firmware → Updates at a time when the network can be down for a few minutes, let it reboot without touching anything, then verify — internet up, VPN connects, one or two known rules working. Major version jumps deserve a quiet weekend morning, not a workday lunch break.
It is rare, and the recovery ladder is honest: first, patience — then the console, which almost always still works and shows boot errors plainly. From the console menu you can reboot cleanly or reach a shell. If the system boots but behaves badly, restore your pre-update configuration backup from the Backups page history or your downloaded file. The true last resort — reinstall and restore the backup — takes under half an hour precisely because you kept that file. This is why the backup is not step two of the update routine; it is the routine.
Watch the video to see the full setup — then adopt the backup-and-update routine from day one, not from the first scare.
▶️ Watch Full VideoCheck monthly and apply minor updates as they come; they are mostly security and bug fixes. Major releases arrive roughly twice a year — apply them within a few weeks, after reading the notes and taking a backup. A firewall left unpatched for a year is quietly becoming the weakest device on the network it protects.
Yes, the XML configuration contains the full system state including certificates and keys, which is exactly why it restores so completely — and why you must store it securely. Anyone holding that file holds the blueprint and several secrets of your network.
Yes. Plugins can push the configuration to Google Drive, Nextcloud and similar services on a schedule, and the system keeps an on-box revision history automatically. Automate it as a second layer — but still download a manual copy before updates and big changes, and know where it lives.