report

How to Backup and Restore Configurations in pfSense 2.0

I always like to backup the configuration of my pfSense system before I do any major changes to the system. If I ever run into a problem I can always reinistall pfSense from the CD and restore the backup file. This makes the process of recovering from a problem much faster and a lot less of a hassle than the alternative of rebuilding everything from scratch.

Even when I'm not planning a major change such as an upgrade I like to make an occasional backup of the configuration. I tend to make many small tweaks to my pfSense systems over time and I don't always remember everything that I have done.

I've also had instances in the past where the hard drive in my router randomly decided to stop working and I was forced to restore from backups, so it's a good idea to always be prepared.

Performing a Manual Backup

To perform a backup of the system configuration click on backup/restore in the diagnostics menu. Make sure the backup area is set to "ALL", then click on download configuration. This will download an xml file which contains all of the configuration settings stored within pfSense.

Other Options

  • Do not backup package information - I usually leave this box unchecked so I can restore the settings for the packages that are installed. If you need to migrate a configuration to another system without the same packages you might need to use this option.
  • Encrypt this configuration file - It is always a good idea to enable encryption on the config file. Passwords are stored in plain text within the xml file so be careful! If you enable this setting you will have to set a password for the file.
  • Do not backup RRD data - This setting is enabled by default and most users will want keep it turned on so the backup files remain small in size. If you do want to backup the data for the graphs within pfSense disable this setting.

Click thumbnail to view full-size
The backup and restore page can be found in the diagnostics menu.To do a full backup set the backup area to "ALL" and click on download configuration.If you want to do a partial backup you can select an individual area.
The backup and restore page can be found in the diagnostics menu.
The backup and restore page can be found in the diagnostics menu.
To do a full backup set the backup area to "ALL" and click on download configuration.
To do a full backup set the backup area to "ALL" and click on download configuration.
If you want to do a partial backup you can select an individual area.
If you want to do a partial backup you can select an individual area.

Automatic Backups

If you manage several pfSense firewalls you might want to consider using the automatic config backup package. To take advantage of this package you must be a pfSense premium portal subscriber.

Once you install the package you will need to enter your support portal username and password. To access the package settings click on AutoConfigBackup in the diagnostics menu.

After you configure the package it will monitor the system for changes. Any time the pfSense configuration is changed a backup of the configuration will be encrypted and transferred to an off-site backup server.

Click thumbnail to view full-size
The auto config backup package can be installed using the package manager.To use the auto config backup service you must have a pfSense support subscription.
The auto config backup package can be installed using the package manager.
The auto config backup package can be installed using the package manager.
To use the auto config backup service you must have a pfSense support subscription.
To use the auto config backup service you must have a pfSense support subscription.

Remote Backups Via SSH

If you don't have a support portal account you can still set up automatic backups.

Every time a change in pfSense is made a backup of the config file is stored in /cf/conf/backup.

You could create a script to run as a cron job on the pfSense system to push the files in this directory to a remote server or network attached storage device.

Or you could also run a script on a remote system which could download the files in the config directory using SSH/SCP.

Click thumbnail to view full-size
Every time a config change is made a backup is created in /cf/conf/backup.Previous config files can be viewed in the web gui by clicking on backup/restore in the diagnostics menu.
Every time a config change is made a backup is created in /cf/conf/backup.
Every time a config change is made a backup is created in /cf/conf/backup.
Previous config files can be viewed in the web gui by clicking on backup/restore in the diagnostics menu.
Previous config files can be viewed in the web gui by clicking on backup/restore in the diagnostics menu.

Performing a Restore

Config files can be restored from the same page you create the backups on. You have the option of selecing a specific area of the config to restore, or "ALL" for a full restoration.

Choosing an individual area is useful in situations where a firewall or nat rule has been deleted but the rest of the system is still fine.

After the config file is restored pfSense will reboot automatically.

Config files can be restored from the same page as they are created on.
Config files can be restored from the same page as they are created on.

Best Practices

I highly recommend setting up a system for automatically backing up your config files. When backups are automated you don't have to worry about remembering to do them.

Make sure to store your config files in a different physical location than the router or firewall you are backing up. In the event of a fire or flood the backup will be useless if it was destroyed along with the system being backed up.

Dropbox offers 2GB of offsite storage for free, making it a perfect location for storing config files.

© 2011 Sam Kear

More by this Author


Comments 7 comments

tamron profile image

tamron 5 years ago

Great Info. on Backup on in pfSense 2.0! I have an old spare computer I tried to backup and save to hard drive. I get black screen with Press F11 to start recovery NTLDR is missing Press Ctrl+Alt+Del to restart. I keep getting an error message still haven't fixed the problem.

Great Hub! Vote up & Ping Ya!


skear profile image

skear 5 years ago from Kansas City Author

Hey tamron,

Thanks for your comment! You might want to consider removing the hard drive from your old computer and connecting it to a working one with a usb adapter. Maybe I should make a hub about that ;)


Ben Tyger 3 years ago

I have started an open-source project deal with pfSense 2.0 automatic backups. You can find it at http://code.google.com/p/pfsense-backups/


Jared 3 years ago

great write up! There is now a $99/yr Gold Subscription that gives you access to the Auto Config Backups. https://portal.pfsense.org/gold-subscription.php


racso 2 years ago

mmmm i think ... this document ommitted says that : if you have a BOX A, with a config and this hardware box a failssss.....then when you get another diferent box "BOX B"...and install iso pfsense , you can install xml file but (paste)... and here comes that i detect was ommited...that's config has a different name to your nic cards....and then if you renamed your still not working at all...i tested tested and allways have the same ....pass my config = ok , but not working like my another box A (not route not get goes to internet )

any one knows how solve restore into diferents hardware......


skear profile image

skear 2 years ago from Kansas City Author

@rasco

If you're moving to different hardware you will need to re-run the interface assignment wizard on the new machine after you have restored the configuration.

This can be done directly from the console of pfSense.


gre 23 months ago

How do you restore from the cf/conf/ folder?

    Sign in or sign up and post using a HubPages Network account.

    0 of 8192 characters used
    Post Comment

    No HTML is allowed in comments, but URLs will be hyperlinked. Comments are not for promoting your articles or other sites.


    Click to Rate This Article

    Menu

    Explore