can't update pfsense or install packages

mrrobot

@stephenw10 said in can't update pfsense or install packages:
for some reason i cant put all the code, it gets reported as spam so i put the end of it

pkg-static -d update

DBG(1)[94031]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_6_0_amd64-pfSense_v2_6_0/meta.conf with opts "i"
DBG(1)[94031]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_6_0_amd64-pfSense_v2_6_0/meta.conf with opts "i"
DBG(1)[94031]> Request to fetch pkg+https://packages.netgate.com/pfSense_v2_6_0_amd64-pfSense_v2_6_0/meta.txz
DBG(1)[94031]> opening libfetch fetcher
DBG(1)[94031]> Fetch > libfetch: connecting
DBG(1)[94031]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_6_0_amd64-pfSense_v2_6_0/meta.txz with opts "i"
DBG(1)[94031]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_6_0_amd64-pfSense_v2_6_0/meta.txz with opts "i"
DBG(1)[94031]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_6_0_amd64-pfSense_v2_6_0/meta.txz with opts "i"
pkg-static: https://pkg01-atx.netgate.com/pfSense_v2_6_0_amd64-pfSense_v2_6_0/meta.txz: No route to host
repository pfSense has no meta file, using default settings
DBG(1)[94031]> Request to fetch pkg+https://packages.netgate.com/pfSense_v2_6_0_amd64-pfSense_v2_6_0/packagesite.pkg
DBG(1)[94031]> opening libfetch fetcher
DBG(1)[94031]> Fetch > libfetch: connecting
DBG(1)[94031]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_6_0_amd64-pfSense_v2_6_0/packagesite.pkg with opts "i"
DBG(1)[94031]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_6_0_amd64-pfSense_v2_6_0/packagesite.pkg with opts "i"
DBG(1)[94031]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_6_0_amd64-pfSense_v2_6_0/packagesite.pkg with opts "i"
pkg-static: https://pkg01-atx.netgate.com/pfSense_v2_6_0_amd64-pfSense_v2_6_0/packagesite.pkg: No route to host
DBG(1)[94031]> Request to fetch pkg+https://packages.netgate.com/pfSense_v2_6_0_amd64-pfSense_v2_6_0/packagesite.txz
DBG(1)[94031]> opening libfetch fetcher
DBG(1)[94031]> Fetch > libfetch: connecting
DBG(1)[94031]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_6_0_amd64-pfSense_v2_6_0/packagesite.txz with opts "i"
DBG(1)[94031]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_6_0_amd64-pfSense_v2_6_0/packagesite.txz with opts "i"
DBG(1)[94031]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_6_0_amd64-pfSense_v2_6_0/packagesite.txz with opts "i"
pkg-static: https://pkg01-atx.netgate.com/pfSense_v2_6_0_amd64-pfSense_v2_6_0/packagesite.txz: No route to host
Unable to update repository pfSense
Error updating repositories!
[2.6.0-RELEASE][admin@xxxxx]/root:

stephenw10

@mrrobot said in can't update pfsense or install packages:

No route to host

Ok, so it has no route. Check Diag > Routes. Make sure there's a valid default route.

Steve

mrrobot

@stephenw10 how do i know that the default route is valid ?

my wan interface ip is the one ending with 228 and its a public ip

looks like my isp giving me x.x.x.228 defaulting to a x.x.x.229 gateway

Screenshot 2023-06-21 at 00.07.05.png

stephenw10

That looks valid. Does the gateway show as up?

Do you have an IPv6 address on any interfaces?
It could be trying to use IPv6. Try setting 'Prefer IPv4' in Sys > Adv > Networking.

Steve

mrrobot

@stephenw10 thank you
Gateway looks fine & Prefer IPv4 over IPv6 is checked

Screenshot 2023-06-21 at 07.56.37.png

stephenw10

And it's still failing with 'no route'?

It could be something upstream returning no-route. Try to ping pkg01-atx.netgate.com directly.

mrrobot

@stephenw10 the ping works fine

[2.6.0-RELEASE][admin@xxxx]/root: ping pkg01-atx.netgate.com
PING pkg01-atx.netgate.com (208.123.73.209): 56 data bytes
64 bytes from 208.123.73.209: icmp_seq=0 ttl=49 time=129.098 ms
64 bytes from 208.123.73.209: icmp_seq=1 ttl=49 time=133.544 ms
64 bytes from 208.123.73.209: icmp_seq=2 ttl=49 time=129.804 ms
^C
--- pkg01-atx.netgate.com ping statistics ---
4 packets transmitted, 3 packets received, 25.0% packet loss
round-trip min/avg/max/stddev = 129.098/130.815/133.544/1.951 ms

stephenw10

And it's still failing with 'no route'?

Try pkg-static -d4 update at the CLI.

mrrobot

@stephenw10 i see a permission denied now

[2.6.0-RELEASE][admin@pfSense.xxxx.local]/root: pkg-static -d4 update
DBG(1)[49613]> pkg initialized
Updating pfSense-core repository catalogue...
DBG(1)[49613]> PkgRepo: verifying update for pfSense-core
DBG(1)[49613]> PkgRepo: need forced update of pfSense-core
DBG(1)[49613]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense-core.sqlite'
DBG(1)[49613]> Request to fetch pkg+https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf
DBG(1)[49613]> opening libfetch fetcher
DBG(1)[49613]> Fetch > libfetch: connecting
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf with opts "i4"
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf with opts "i4"
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf with opts "i4"
DBG(1)[49613]> Request to fetch pkg+https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz
DBG(1)[49613]> opening libfetch fetcher
DBG(1)[49613]> Fetch > libfetch: connecting
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz with opts "i4"
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz with opts "i4"
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz with opts "i4"
pkg-static: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz: Permission denied
repository pfSense-core has no meta file, using default settings
DBG(1)[49613]> Request to fetch pkg+https://packages.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.pkg
DBG(1)[49613]> opening libfetch fetcher
DBG(1)[49613]> Fetch > libfetch: connecting
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.pkg with opts "i4"
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.pkg with opts "i4"
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.pkg with opts "i4"
pkg-static: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.pkg: Permission denied
DBG(1)[49613]> Request to fetch pkg+https://packages.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.txz
DBG(1)[49613]> opening libfetch fetcher
DBG(1)[49613]> Fetch > libfetch: connecting
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.txz with opts "i4"
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.txz with opts "i4"
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.txz with opts "i4"
pkg-static: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.txz: Permission denied

.......
Error updating repositories!

stephenw10

Aha! Well that is almost always something blocking it.

Are you running Snort or Suricata? pfBlocker maybe? Check it's not blocking that traffic.

mrrobot

@stephenw10 i had to google all this tools to know about em, i don't have any of these
the router had only the os installed, i have been unable to install nothing else

mrrobot

@stephenw10

[2.6.0-RELEASE][admin@pfSense.xxxx.local]/root: pkg info | grep 'snort|suricata|pfb'
[2.6.0-RELEASE][admin@pfSense.xxxx.local]/root:

stephenw10

Something is blocking it. Do you see anything in the firewall logs?

mrrobot

@stephenw10 i see the same log repeating over & over

Screenshot 2023-06-21 at 14.52.15.png

stephenw10

Is your WAN using a private IP?

If not what is that rule? Is that something you added?

Do you see the TCP traffic from pkg blocked there also?

mrrobot

@stephenw10 said in can't update pfsense or install packages:

is your WAN using a private IP?

yes, its 10.x.x.x

mrrobot

@stephenw10 said in can't update pfsense or install packages:

Do you see the TCP traffic from pkg blocked there also?

where ?

stephenw10

In the firewall log.

However if you have added block rules on WAN or floating they may not be set to log. Have you added rules there?

mrrobot

@stephenw10 i have no block rule on WAN interface

Screenshot 2023-06-21 at 15.15.26.png

in the log i see ICMP traffic blocked not TCP

Screenshot 2023-06-21 at 15.16.05.png

stephenw10

Those ping blocks are frequent. Were you running pkg update at the time to generate some tcp traffic.

Also they are shown blocked from the WAN IP to the gateway but not shown as outbound....

Do you have any rules on the floating tab?

You also have a pass all IPv4 rule on WAN which is almost always a bad idea. I assume you added that just as a test.