22.05-RELEASE (amd64) Unable to check for updates?

stephenw10

Ok, check the state tables in Diag > States for traffic from the firewall only on port 53 when you try to resolve something in Diag > DNS Lookup.

Something must be blocking or at least re-routing that traffic.

DefenderLLC

You don't have a UniFi device with ad blocking enabled, do you? Because if you do, it redirects all 53/UDP traffic to it's own resolver regardless what you have configured on your client devices.

TAC57

@stephenw10 It's weird DNS Lookup will find things and now I just ran it again with 'firmware.netgate.com' and I get 'could not be resolved'.

stephenw10

Ok, so there you've got a LAN client successfully connecting to 9.9.9.9 creating states on LAN and WAN.
And you have an unsuccessful connection via the TG_VPN interface.

Is Unbound configured to use TG_VPN as it's outbound interface? And that interface is down?

The fact it's connecting to 9.9.9.9 there though means it's not Unbound resolving directly. Is it still set to forwarding mode?

All of that looks like you might have followed some instructions from a VPN provider at some point. Is that possible?

Steve

TAC57

@stephenw10
Is Unbound configured to use TG_VPN as it's outbound interface? And that interface is down?

The fact it's connecting to 9.9.9.9 there though means it's not Unbound resolving directly. Is it still set to forwarding mode?

All of that looks like you might have followed some instructions from a VPN provider at some point. Is that possible?
Yes, but I've set a rule to force a single source (192.168.30.117) through the TorGuard VPN gateway
https://torguard.net/article/254/how-to-setup-the-latest-pfsense-openvpn-client.html

haraldinho

This sounds really a lot like the problem I am having at the moment after I upgrade to 23.05. See my post for more details.

@TAC57 when you ssh into the firewall and run ps -auxwwd, do you also see traces of an upgrade process?

stephenw10

If you disable forwarding mode and ssl/tls does it then resolve correctly?

TAC57

@stephenw10 firmware.netgate.com could not be resolved.

I would be glad to take a phone call on this if you ever do that. DM me if you want.

stephenw10

Do you at least see states on WAN on port 53 when you try to resolve it?

TAC57

@stephenw10
Like this?
WAN tcp 96.46.xx.xx:31132 (192.168.30.112:45300) -> 8.8.4.4:53 FIN_WAIT_2:FIN_WAIT_2 4 / 4 277 B / 409 B

TAC57

I dumped 23.05 from my backup pfSense computer and reloaded 2.6.0 CE and an old config and everything is working perfectly. This backup computer is identical hardware to my primary pfSense unit.

System reports it's on the latest version (2.6.0-RELEASE)
DNS Lookup doesn't time out
Package Manager reports installed packages
VPN is working and is routing traffic according my my filters
Jumping between menus / tabs is way faster

If anyone has suggestions fixing the 23.05 issues listed above I'd be glad to jump back to my primary pfSense 23.05 box and try them out.

stephenw10

@TAC57 said in 22.05-RELEASE (amd64) Unable to check for updates?:

Like this?
WAN tcp 96.46.xx.xx:31132 (192.168.30.112:45300) -> 8.8.4.4:53 FIN_WAIT_2:FIN_WAIT_2 4 / 4 277 B / 409 B

Not like that. That's a connection from a LAN side client that's being NAT'd. Unbound would be using the WAN directly with no NAT.

The only issue with Unbound I'm aware of only applied to DoT only so disabling that would have removed it.
https://redmine.pfsense.org/issues/14056

You can try the workaround there: https://redmine.pfsense.org/issues/14056#note-6 However I wouldn't expect it to do anything to a default resolver config.

Steve