The primary reason is to have a firewall that will be always up-to-update, unlike most commercial customer grade firewalls that are only supported for a few years. Having a firewall that runs opensource software - it’s based on FreeBSD - also make it easier to review and to verify that there are no back doors.
When I tried to upgrade it to the latest release - 19.1.7 - the upgrade failed because the filesystem ran out of inodes. There is already a topic about this at the OPNsense forum and a fix available for the upcoming nano OPNsense images.
But this will only resolve the issue when a new image becomes available and would require a reinstallation of the firewall.
Create a backup with the old-school dd, just in case.
123456
root@freebsd:~ # dd if=/dev/da0 of=/home/staf/opnsense.dd bs=4M status=progress
4013948928 bytes (4014 MB, 3828 MiB) transferred 415.226s, 9667 kB/s
957+1 records in
957+1 records out
4017807360 bytes transferred in 415.634273 secs (9666689 bytes/sec)
root@freebsd:~ #
mount
Verify that we can mount the filesystem.
1234567891011121314151617
root@freebsd:/ # mount /dev/da0a /mnt
root@freebsd:/ # cd /mnt
root@freebsd:/mnt # ls
.cshrc dev net
.probe.for.install.media entropy proc
.profile etc rescue
.rnd home root
COPYRIGHT lib sbin
bin libexec sys
boot lost+found tmp
boot.config media usr
conf mnt var
root@freebsd:/mnt # cd ..
root@freebsd:/ # df -i /mnt
Filesystem 1K-blocks Used Avail Capacity iused ifree %iused Mounted on
/dev/da0a 3916903 1237690 2365861 34% 38203 6595 85% /mnt
root@freebsd:/ #
umount
1
root@freebsd:/ # umount /mnt
dump
We’ll a create a backup with dump, we’ll use this backup to restore it again after we created a new filesystem with enough inodes.
123456789101112131415161718192021
root@freebsd:/ # dump 0uaf /home/staf/opensense.dump /dev/da0a
DUMP: Date of this level 0 dump: Sun May 19 10:43:56 2019
DUMP: Date of last level 0 dump: the epoch
DUMP: Dumping /dev/da0a to /home/staf/opensense.dump
DUMP: mapping (Pass I) [regular files]
DUMP: mapping (Pass II) [directories]
DUMP: estimated 1264181 tape blocks.
DUMP: dumping (Pass III) [directories]
DUMP: dumping (Pass IV) [regular files]
DUMP: 16.21% done, finished in 0:25 at Sun May 19 11:14:51 2019
DUMP: 33.27% done, finished in 0:20 at Sun May 19 11:14:03 2019
DUMP: 49.65% done, finished in 0:15 at Sun May 19 11:14:12 2019
DUMP: 66.75% done, finished in 0:09 at Sun May 19 11:13:57 2019
DUMP: 84.20% done, finished in 0:04 at Sun May 19 11:13:41 2019
DUMP: 99.99% done, finished soon
DUMP: DUMP: 1267205 tape blocks on 1 volume
DUMP: finished in 1800 seconds, throughput 704 KBytes/sec
DUMP: level 0 dump on Sun May 19 10:43:56 2019
DUMP: Closing /home/staf/opensense.dump
DUMP: DUMP IS DONE
root@freebsd:/ #
newfs
According to the newfs manpage:
We can specify the inode density with the -i option. A lower number will give use more inodes.
1234567
root@freebsd:/ # newfs -i 1 /dev/da0a
density increased from 1 to 4096
/dev/da0a: 3831.7MB (7847280 sectors) block size 32768, fragment size 4096
using 8 cylinder groups of 479.00MB, 15328 blks, 122624 inodes.
super-block backups (for fsck_ffs -b #) at:
192, 981184, 1962176, 2943168, 3924160, 4905152, 5886144, 6867136
root@freebsd:/ #
The installation had a OPNsense_Nano label, underscores are not allowed anymore in label name on FreeBSD 12.
So I used OPNsense instead, we’ll update /etc/fstab with the new label name.
