Hi everyone,
I just wanted to share my experience migrating three firewalls (2 boxes and 1 physical server) from NethSecurity 7 to 8.
The fact that I could boot from a USB drive gave me peace of mind during the process, knowing I could easily disconnect it and revert to the previous setup if needed. This made me feel much more comfortable proceeding with the upgrade.
For a migration, it was surprisingly painless. However, there are a few things to double-check afterward, which I’d like to share with you.
Once I downloaded the image from the old NethSecurity 7 using the migration tool and wrote it to a USB drive, 80% of the migration was already done on all three devices.
Here are a few things to double-check:
- IPsec VPNs:
If you have any active IPsec VPNs, make sure the route specifying the interface for the VPN was migrated correctly. I had some issues with the tunnel going up, but I reported the bug so it will likely be fixed soon.
If it isn’t created automatically, create it yourself.
Here’s an example of the route needed:
-
2FA:
You’ll need to set up 2FA again to get a new QR code for UI login.
Be careful when enabling LUCI, as it will allow access to the Luci UI without 2FA!
(I advise against enabling it) -
Firewall Rules:
Check if any firewall rules aren’t working
If so, try removing the source zone and leaving it as “any.”
From the tests I’ve done, it seems that if both zones are assigned, it doesn’t seem to work properly -
FlashStart:
If you use FlashStart, make sure the blue interface is active as well. In my case, it was only active for the green interface. -
Threat Shield:
Enable Threat Shield even without active lists (I recommend FireHOL level 1 compilation) to enable banIP (the old fail2ban). I’m still having some issues with this, but tech support is working on it -
MultiWAN:
If you use MultiWAN, make sure the WANs are set up correctly. You’ll probably find them in balance mode.
If you had them in backup mode, switch them back. -
DNS Resolution with Windows Domain Controller and VLANs:
If you have a Windows Domain Controller and some clients are on the green interface while others are on a guest VLAN (in a different network class than the server), you might find that clients on the VLAN will no longer be able to authenticate and query the domain controller.
Obviously the clients had the IP of the domain controller as DNS on the network card.
This is likely due to NethSecurity 8 handling DNS requests differently than NethSecurity 7, even if you manually set the domain controller IP as dns in the firewall and create the correct DNS record.
The solution is to specify the domain controller IP in the DNS settings of the firewall, using this syntax:
/domainname/serverip
In this case, requests are handled correctly.
Overall, I’m happy with the migration. NethSecurity 8 feels much smoother and more responsive.
Ok, obviously there are some things to fix manually but it was much easier and faster than I expected.
Good job
I hope that I was helpful to those who will migrate!
