Migrate pfSense to OPNsense 26.7 with pfopn-convert

Rebuilding a firewall by hand means hundreds of rules, port forwards and VPN settings to copy without a typo. pfopn-convert takes a pfSense CE config backup and turns it into an OPNsense 26.7 config you can restore on a fresh install, then checks the result before you restore it.

Rust CLI
pfSense CE
OPNsense 26.7
BSD-2-Clause

Download View on GitHub

This is a fork of sheridans/pfopn-convert by Sheridan Computers Limited, who wrote the converter it builds on. The fork focuses on pfSense CE (config version 24.6) → OPNsense 26.7. It fixes conversion bugs that silently changed firewall behaviour, and adds OPNsense 26.7's new rule format and more conversions.

Tested on real firewalls

It was used to migrate three production pfSense firewalls to OPNsense 26.7.8:

a multi-WAN box with policy routing, about 100 rules, 58 port forwards, virtual IPs, DNS Resolver, remote syslog, Zabbix agent and node_exporter;
a VPN box with an OpenVPN server using LDAP users, two IKEv2 site-to-site tunnels and a Zabbix proxy;
a two-WAN box with port forwards grouped by separators, OpenVPN and IPsec, SNMP and pfBlockerNG IP lists.

What it converts

Firewall rules, port forwards, outbound NAT, 1:1 NAT and NPt, written in OPNsense 26.7's new rule model so you can still edit them in the GUI.
Interfaces, VLANs, bridges, virtual IPs, aliases, gateways and static routes.
DHCP (to Kea or ISC), DNS Resolver (Unbound), remote syslog and LDAP servers.
OpenVPN servers, IPsec site-to-site tunnels and WireGuard.
Plugins: Zabbix agent and proxy, node_exporter, SNMP and the QEMU guest agent, when the plugin is installed on the destination.
pfSense rule separators become OPNsense rule categories.
pfSense behaviour OPNsense doesn't reproduce by itself, such as automatic IPsec rules and outbound NAT for OpenVPN tunnel networks.

Everything it can't convert is printed as a warning, so nothing is dropped silently. The support table lists every area and its limitations.

Install

Prebuilt binaries for Linux (x86_64, aarch64), FreeBSD, macOS and Windows are on the releases page, with a SHA256SUMS file. On Linux:

curl -fsSLO https://github.com/Silureth/pfopn-convert/releases/latest/download/pfopn-convert-linux-x86_64.tar.gz
tar -xzf pfopn-convert-linux-x86_64.tar.gz
./pfopn-convert scan config-pfsense.xml --to opnsense

How a migration works

You need two config exports: the source from pfSense, and a baseline from a fresh OPNsense install of the exact version you'll run, with the same number of interfaces assigned in the same order and the needed plugins installed. The converter writes the source's settings into the baseline:

pfopn-convert scan source-pfsense.xml --to opnsense
pfopn-convert convert source-pfsense.xml --from pfsense --to opnsense \
  --target-file opnsense-baseline.xml --output converted.xml
pfopn-convert verify converted.xml --to opnsense --strict

Restoring replaces the whole configuration and can cut you off from the network. Restore only onto a fresh OPNsense install, with only an isolated network connected, and keep a way back (a VM snapshot, or the old firewall ready to start).

The full 12-step workflow also covers checking the ruleset, the cutover, and two problems that only show up afterwards: stale firewall states and empty URL table aliases.

Sharing configs safely

The repository also includes tools/sanitize_config.py. It anonymizes a config backup (passwords, keys, public IPs, domains) before you share it, for example in a bug report, and checks at the end that no secret is left.