As neededpost-upgrade

Post-Upgrade Checklist

16 items ·13 critical ·1 warn ·2 info

An OPNsense firmware upgrade is not complete when the box reboots: it is complete when every service, interface, VPN tunnel, rule, IDS instance, and log path is back to a known-good state. This checklist forces that validation to be explicit and traceable so a regression is caught inside the maintenance window, not three days later by a downstream team.

When to use

Use this checklist after every OPNsense firmware upgrade — minor, major, and security releases. Use it on both nodes of an HA pair after each node upgrade. Use it after a plugin upgrade that triggers a service restart.

How to use

Walk the list, run the explicit validation tests, capture rule counters and log samples as evidence, and close the change record. Anything with severity critical must pass before the maintenance window closes. If a critical item cannot be validated within the rollback time budget, initiate the documented rollback.

Critical13 items

Firmware version matches the planned target; reboot count is at the expected value.
```
System > Firmware > Status; uname -a.
```
All interfaces are up with the expected addresses and link state.
```
Interfaces > Assignments; ifconfig -a.
```
All enabled services are running: Unbound, DHCP (where used), VPN daemons, Suricata.
```
Status > Services; `service <name> status` from shell.
```
CARP / HA state is correct: expected master is master, expected backup is backup; VIPs are on the master.
```
Status > CARP; System > High Availability > Status.
```
Firewall rules are loaded and active; rule counters increment for a representative flow.
```
Firewall > Rules; `pfctl -sr` from shell.
```
Outbound NAT rules are present and applied for every internal subnet on every WAN gateway.
```
Firewall > NAT > Outbound; `pfctl -sn`.
```
VPN tunnels have re-established: IPsec SAs visible, WireGuard peers showing recent handshake.
```
Status > IPsec; VPN > WireGuard > Status; `wg show`.
```
DNS resolution works from inside (Unbound) and from outside (forwarders); DNSSEC validation passes for signed zones.
```
drill -D example.com @127.0.0.1; dig +dnssec.
```

IDS / Suricata is running, rule sets loaded, EVE log shipping to SIEM.

Services > Intrusion Detection > Administration; Services > Intrusion Detection > Log File.

Remote syslog is healthy: sample of firewall, system, and IDS logs arrive at the SIEM within 60 seconds.
Configuration backup is healthy post-upgrade: scheduled backup runs and lands at the destination.
```
System > Configuration > Backups; tail -F /var/log/configd/latest.log
```
No unexpected errors in system log for the upgrade window; warnings reviewed and accepted.
```
less /var/log/system/latest.log
```
Change record is closed with the post-upgrade artefacts and a follow-up is created if any open issue remains.

Warning1 item

API endpoints respond; downstream automation (Ansible, monitoring) reconnects without manual intervention.
```
curl -sk -u "$KEY:$SECRET" https://<firewall>/api/core/system/status
```

Info2 items

Monitoring metrics (Netdata / Prometheus exporter / SNMP) return data; meta-monitoring rule is still firing.
Performance baseline is re-captured and compared to the pre-upgrade baseline; anomalies are investigated.
```
pfctl -ss | wc -l; top -b -n 1; netstat -I.
```