pfsense-plus-pkg.netgate.com no DNS resolving

bmeeks

Some of the "URLs" associated with the pkg system on pfSense are DNS service records and not typical A records. You can't resolve service records using tools such as nslookup unless you explicitly pass the optional parameter to specify the record type.

Here is a quick overview of SRV (service) records in DNS: https://www.nslookup.io/learning/dns-record-types/srv/.

Because SRV records are not the same as A records, and because tools such as ping expect either A records or CNAME records as input, they will fail to resolve SRV records supplied as the "destination target" for a ping.

Gertjan

@bootable said in pfsense-plus-pkg.netgate.com no DNS resolving:

the URL or FQDN pfsense-plus-pkg.netgate.com has not a DNS entry

It has.
There is more then A or AAAA

See packages.netgate.com Has no A/AAAA Record

bootable

@gertjan How the system know to whats host must go to request a SRV entry if the FQDN of the SRV entry is not resolved ?

How nows the IP of the FQDN into the SRV entry to access the services published into the DNS SRV entry?

bootable

@bootable I understand you, just let me know how the system knows to with host goes to request the entry on the SRV record if the FQDN into the SRV record does not have an host type A or AAA

Gertjan

@bootable said in pfsense-plus-pkg.netgate.com no DNS resolving:

the system knows to with host

Again, sorry : [packages.netgate.com Has no A/AAAA Record](packages.netgate.com Has no A/AAAA Record)

I agree, you might see that page as "not an answer". That means you didn't understand your question ;)

bootable

Gertjan

@bootable

IMHO : best advise right now :
If, by any chance, there is something not ok on their (Netgate) side, don't start messing around.
This day is special, 99 % of all people 'are not at work' today.

For me, right now, using a pfSense 23.01 :

Enter an option: 13

>>> Updating repositories metadata...
Updating pfSense-core repository catalogue...
Fetching meta.conf: . done
Fetching packagesite.pkg: . done
Processing entries: .. done
pfSense-core repository update completed. 15 packages processed.
Updating pfSense repository catalogue...
Fetching meta.conf: . done
Fetching packagesite.pkg: .......... done
Processing entries: .......... done
pfSense repository update completed. 537 packages processed.
All repositories are up to date.
Your packages are up to date

bootable

@gertjan said in pfsense-plus-pkg.netgate.com no DNS resolving:

I agree, you might see that page as "not an answer". That means you didn't understand your question ;)

Thats happen with me

stephenw10

The pkg servers are not down and have not been AFAIK:

[23.01-RELEASE][root@6100.stevew.lan]/root: pfSense-upgrade -c
>>> Updating repositories metadata... done.
Your system is up to date
[23.01-RELEASE][root@6100.stevew.lan]/root: pkg update
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.

What error are you seeing from pkg -d update?

In your output above you see 'no route to host', do you have default route?

bootable

@stephenw10 Yes I have a default route

stephenw10

@stephenw10 said in pfsense-plus-pkg.netgate.com no DNS resolving:

What error are you seeing from pkg -d update?

bootable

@stephenw10

stephenw10

Shows no route still not that it can't resolve it. Try: pkg -d4 update

bootable

@stephenw10

Gertjan

@bootable

Your pfSense can't reach the destination.
This could be a local issue, or anywhere upstream.
And an extra possibility for you : you use a VM ....

edit

pkg -4 -d4 update

to force IPv4 usage ( and not the preferred IPv6 )

bootable

@gertjan yes that box is in a VM, directly connected to internet ( the WAN of the VM hasta Public ip address)

bootable

@bootable said in pfsense-plus-pkg.netgate.com no DNS resolving:

@stephenw10

stephenw10

Yeah it appears to be trying to use v6 and has no v6 routes.

-d4 forces it to use v4 and debug output.

The fact it's just timing out implies it still cannot reach it.

What routes do you have there? You have a default gateway set that is a gateway group with only one gateway in it. Which is odd.
Check Diag > Routes (or netstat -rn at the cli) to be sure you actually have a default route. And that you don't have any rogue routes that might be matching the server address.

bootable

@stephenw10

Using username "admin".
Keyboard-interactive authentication prompts from server:
| Password for admin@fw_pfsense.ycc.lan:
End of keyboard-interactive prompts from server
VMware Virtual Machine - Netgate Device ID: 5c18ec2339d787f345ad

*** Welcome to Netgate pfSense Plus 23.01-RELEASE (amd64) on fw_pfsense ***

 WAN (wan)       -> vmx1       -> v4: 000.000.000.000/24
 LAN (lan)       -> vmx0       -> v4: 000.000.000.000/24
 DMZ (opt1)      -> vmx2       -> v4: 000.000.000.000/24

 0) Logout (SSH only)                  9) pfTop
 1) Assign Interfaces                 10) Filter Logs
 2) Set interface(s) IP address       11) Restart webConfigurator
 3) Reset webConfigurator password    12) PHP shell + Netgate pfSense Plus tools
 4) Reset to factory defaults         13) Update from console
 5) Reboot system                     14) Disable Secure Shell (sshd)
 6) Halt system                       15) Restore recent configuration
 7) Ping host                         16) Restart PHP-FPM
 8) Shell

Enter an option: 8

[23.01-RELEASE][admin@fw_pfsense.ycc.lan]/root: clear
[23.01-RELEASE][admin@fw_pfsense.ycc.lan]/root: pkg -4 -d4 update
DBG(1)[75729]> pkg initialized
Updating pfSense-core repository catalogue...
DBG(1)[75729]> PkgRepo: verifying update for pfSense-core
DBG(1)[75729]> PkgRepo: need forced update of pfSense-core
DBG(1)[75729]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense-core.sqlite'
DBG(1)[75729]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-core/meta.conf
DBG(1)[75729]> opening libfetch fetcher
DBG(1)[75729]> Fetch > libfetch: connecting
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/meta.conf with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/meta.conf with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/meta.conf with opts "i4"
DBG(1)[75729]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-core/meta.txz
DBG(1)[75729]> opening libfetch fetcher
DBG(1)[75729]> Fetch > libfetch: connecting
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/meta.txz with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/meta.txz with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/meta.txz with opts "i4"
pkg: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/meta.txz: Operation timed out
repository pfSense-core has no meta file, using default settings
DBG(1)[75729]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.pkg
DBG(1)[75729]> opening libfetch fetcher
DBG(1)[75729]> Fetch > libfetch: connecting
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.pkg with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.pkg with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.pkg with opts "i4"
pkg: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.pkg: Operation timed out
DBG(1)[75729]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.txz
DBG(1)[75729]> opening libfetch fetcher
DBG(1)[75729]> Fetch > libfetch: connecting
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.txz with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.txz with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.txz with opts "i4"
pkg: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.txz: Operation timed out
Unable to update repository pfSense-core
Updating pfSense repository catalogue...
DBG(1)[75729]> PkgRepo: verifying update for pfSense
DBG(1)[75729]> PkgRepo: need forced update of pfSense
DBG(1)[75729]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense.sqlite'
DBG(1)[75729]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.conf
DBG(1)[75729]> opening libfetch fetcher
DBG(1)[75729]> Fetch > libfetch: connecting
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.conf with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.conf with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.conf with opts "i4"
DBG(1)[75729]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.txz
DBG(1)[75729]> opening libfetch fetcher
DBG(1)[75729]> Fetch > libfetch: connecting
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.txz with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.txz with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.txz with opts "i4"
pkg: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.txz: Operation timed out
repository pfSense has no meta file, using default settings
DBG(1)[75729]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.pkg
DBG(1)[75729]> opening libfetch fetcher
DBG(1)[75729]> Fetch > libfetch: connecting
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.pkg with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.pkg with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.pkg with opts "i4"
pkg: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.pkg: Operation timed out
DBG(1)[75729]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.txz
DBG(1)[75729]> opening libfetch fetcher
DBG(1)[75729]> Fetch > libfetch: connecting
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.txz with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.txz with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.txz with opts "i4"
pkg: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.txz: Operation timed out
Unable to update repository pfSense
Error updating repositories!
[23.01-RELEASE][admin@fw_pfsense.ycc.lan]/root:

netstat -rn
Routing tables

Internet:
Destination        Gateway            Flags     Netif Expire
default            000.000.000.000        UGS        vmx1
1.1.1.1            000.000.000.000        UGHS       vmx1
10.10.1.5          link#10            UHS         lo0
10.10.1.6          link#10            UH       ovpns2
10.10.1.8          link#8             UHS         lo0
10.10.1.8/30       link#8             U       tun_wg0
10.10.10.0/24      link#9             U        ovpns1
10.10.10.1         link#9             UHS         lo0
127.0.0.1          link#5             UH          lo0
000.000.000.000/24      link#2             U          vmx1
000.000.000.000        link#2             UHS         lo0
000.000.000.000        link#2             UHS        vmx1
192.168.2.0/24     10.10.1.6          UGS      ovpns2
192.168.3.0/24     10.10.1.6          UGS      ovpns2
192.168.1N.0/24    link#1             U          vmx0
192.168.1X.1       link#1             UHS         lo0
192.168.1X.0/24    link#3             U          vmx2
192.168.1X.1       link#3             UHS         lo0

Internet6:
Destination                       Gateway                       Flags     Netif Expire
::1                               link#5                        UHS         lo0
fe80::%vmx0/64                    link#1                        U          vmx0
fe80::20c:29ff:fef6:61a9%vmx0     link#1                        UHS         lo0
fe80::%vmx1/64                    link#2                        U          vmx1
fe80::20c:29ff:fef6:61b3%vmx1     link#2                        UHS         lo0
fe80::%vmx2/64                    link#3                        U          vmx2
fe80::20c:29ff:fef6:61bd%vmx2     link#3                        UHS         lo0
fe80::%lo0/64                     link#5                        U           lo0
fe80::1%lo0                       link#5                        UHS         lo0
fe80::%ovpns1/64                  link#9                        U        ovpns1
fe80::20c:29ff:fef6:61a9%ovpns1   link#9                        UHS         lo0
fe80::%ovpns2/64                  link#10                       U        ovpns2
fe80::20c:29ff:fef6:61a9%ovpns2   link#10                       UHS         lo0
[23.01-RELEASE][admin@fw_pfsense.ycc.lan]/root:

stephenw10

What happens if you try to fetch that file directly?:

[23.01-RELEASE][root@6100.stevew.lan]/root: fetch https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.txz
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg01.atx.netgate.com
36630304624640:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_01-main/sources/FreeBSD-src-plus-RELENG_23_01/crypto/openssl/ssl/statem/statem_clnt.c:1921:
fetch: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.txz: Authentication error

You should see an authentication error like that fetching directly.