Netgate 1100 dns stops

[Gertjan]

@freek_box
Noop.
The 'crypto chip' van't be reset using a command.
A 10 seconds power down can bring it back online.

edit : that is : a clean, commanded power down by the GUI or console(SSH),. Some ripping out the power and put it back in again could create other issues like a dirty file system.

So : console or SSH option 6.
Or GUI : Diagnostics > Halt System
Let the system shut down.
Then, remove the power for 10 seconds.
Power back in.
Done.

[stephenw10]

@freek_box said in Netgate 1100 dns stops:

only rebooting is not enough?

It is not. The crypto chip remains powered as long as the PSU is connected to the device.

Steve

[Freek_Box]

So how do I know if I'm on the correct version? I also have a VPS running with version:

[Gertjan]

@freek_box
You didn't notice it, way back in 2021, that this info

is refreshed every couple of hours or so.

And then yours stopped refreshing for 18 months => not showing that you missed several major updates.
Like being on Windows 7, and don't know that 8, 8,1 and then 10 - and now 11 saw the light.

Or look here : https://www.pfsense.org/download/

Or look here : https://www.netgate.com/blog/tag/releases

Or on the dashboard of pfSense itself :

No joke : never - ever - trust automated system : you have to check (a couple of clicks actually) to see if a newer "version" is available.

2.4.4 is .... ancient.

Check out Troubleshooting Upgrades.

[Freek_Box]

@gertjan LOL I did not see that 2021 damm alright thnx!

[Freek_Box]

I also have a old machine with pfsense on it see screenshot by switching it from branch it now sees it can be updated. Is this device safely to update to 2.5 I though there was something with this hardware that it could not run a newer version or something?

[SteveITS]

@freek_box That's not an 1100 I take it? It might be clearer to start a new thread for a different topic...

You might be thinking of AES-NI which Netgate originally planned to make required, but backed away from that 2-3 years ago.

[stephenw10]

Yes, you should be able to update that. It will probably end up going to 2.6 directly once you start the process. Be sure to backup the config in case you do need to reinstall.

Steve

[Freek_Box]

So I tried to do the update from 2.4.4 to 2.4.5 but it got in an error. Now if I go to the update screen it says:

The error report:
[30-Sep-2022 07:43:55 UTC] PHP Warning: PHP Startup: Unable to load dynamic library 'readline.so' (tried: /usr/local/lib/php/20170718/readline.so (Shared object "libreadline.so.7" not found, required by "readline.so"), /usr/local/lib/php/20170718/readline.so.so (Cannot open "/usr/local/lib/php/20170718/readline.so.so")) in Unknown on line 0

[stephenw10]

You likely can't upgrade to 2.4.5 because there is no branch existing for that. The 'previous stable' branch is 2.5.2 at this point.
The only way to get to 2.4.5 would be to reinstall to it.

That particular PHP error is known during upgrade and is not normally an issue. However it looks like it attempted and failed to upgrade to 2.4.5 so the current state is unknown.

You may be able to recover it as shown here:
https://docs.netgate.com/pfsense/en/latest/troubleshooting/upgrades.html#upgrade-not-offered-library-errors

If you have the option though I would just install 22.05 clean and restore your config.

Steve

[Freek_Box]

@stephenw10

So maybe a stupid question but how would I install 22.05? Do I have to create a bootable USB or something?

[stephenw10]

If you want to reinstall cleanly then yes. Open a ticket with us to get the recovery image:
https://www.netgate.com/tac-support-request

Assuming this is still for an 1100 instructions are here:
https://docs.netgate.com/pfsense/en/latest/solutions/sg-1100/reinstall-pfsense.html

Steve

[SteveITS]

@freek_box https://docs.netgate.com/pfsense/en/latest/solutions/sg-1100/reinstall-pfsense.html

[Freek_Box]

No this is not for the 1100 but for the other machine,
I got it upgraded to 2.4.5:

But know I'm getting more php erros:

Warning: PHP Startup: Unable to load dynamic library 'curl.so' (tried: /usr/local/lib/php/20170718/curl.so (Shared object "libcurl.so.4" not found, required by "curl.so"), /usr/local/lib/php/20170718/curl.so.so (/usr/local/lib/php/20170718/curl.so.so: invalid file format)) in Unknown on line 0

Warning: PHP Startup: Unable to load dynamic library 'mbstring.so' (tried: /usr/local/lib/php/20170718/mbstring.so (Shared object "libonig.so.5" not found, required by "mbstring.so"), /usr/local/lib/php/20170718/mbstring.so.so (/usr/local/lib/php/20170718/mbstring.so.so: invalid file format)) in Unknown on line 0

Warning: PHP Startup: Unable to load dynamic library 'rrd.so' (tried: /usr/local/lib/php/20170718/rrd.so (Shared object "librrd.so.8" not found, required by "rrd.so"), /usr/local/lib/php/20170718/rrd.so.so (/usr/local/lib/php/20170718/rrd.so.so: invalid file format)) in Unknown on line 0

I can connect from my computer to it but can't go on the internet for some reason that is not working

When I do:
pkg-static clean -ay; pkg-static install -fy pkg pfSense-repo pfSense-upgrade

I get the error:

Updating pfSense-core repository catalogue...
Certificate verification failed for /C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services
12835124:error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_4_5_amd64/usr/src/crypto/openssl/ssl/s3_clnt.c:1269:

[Freek_Box]

Ah the DNS resolver is not starting:

[SteveITS]

@freek_box said in Netgate 1100 dns stops:

No this is not for the 1100

That's why it's confusing to post multiple questions in one thread. :)

There are manuals online with instructions for other Netgate devices. Otherwise this is for CE, for your own hardware:
https://docs.netgate.com/pfsense/en/latest/install/index.html

[Freek_Box]

@steveits

Yeah your right maybe start a new post, only I have a question if I install the new version will the certificat problem be solved or does it indeed have to do with my hardware?

[Gertjan]

@freek_box said in Netgate 1100 dns stops:

will the certificat problem be solved or does it indeed have to do with my hardware?

You mean the "crypto chip reset procedure" ?
As said : shut down pfSense with the GUI or SSH/console command.
Wait for it too shut down.
Remove the power xx seconds.
Power up.
.....
Install a recent version - that is 2.6.0 on non Netgate devices, and contact TAC for 22.05. Brunr the USB drives. Install and call it a day.

[Freek_Box]

@gertjan

No I mean that this error that I"m now getting on the Deciso pfsense firewall:

Certificate verification failed for /C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services
12835124:error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_v2_4_5_amd64/usr/src/crypto/openssl/ssl/s3_clnt.c:1269:

[rcoleman-netgate]

@freek_box Backup your config.

If it is a Netgate box (non-APU or MinnowBoard) open a ticket at https://go.netgate.com/ for the firmware
Other: download from https://pfsense.org/download/

Install
Restore config
Use system
.....
Profit?