Having an exported configuration is not the same as knowing that a replacement firewall can restore service. A useful drill has to catch dependencies that are not obvious in the XML, such as plugin versions, certificates, interface assignments, encryption keys, external authentication, and hardware-specific settings.
I am considering a spare or virtual appliance with the same OPNsense release and plugins, restored on an isolated network. The drill would map interfaces explicitly, confirm admin access and console recovery, validate DHCP and DNS, test representative firewall and NAT rules, bring up each VPN, and compare a sanitized configuration digest with the intended source. It would also record which secrets or certificates require a separate recovery path.
What commonly restores cleanly but fails later in real use? How do you test CARP or high availability, aliases fed by external URLs, Unbound overrides, WireGuard or IPsec state, and plugin data without risking production traffic? Which parts of the backup should be tested after every change versus on a slower schedule?
Source: r/opnsense · by /u/RocketSeven