can't update pfsense or install packages

stephenw10 · Jun 21, 2023, 12:33 PM

And it's still failing with 'no route'?

Try pkg-static -d4 update at the CLI.

mrrobot · Jun 21, 2023, 12:36 PM

@stephenw10 i see a permission denied now

[2.6.0-RELEASE][admin@pfSense.xxxx.local]/root: pkg-static -d4 update
DBG(1)[49613]> pkg initialized
Updating pfSense-core repository catalogue...
DBG(1)[49613]> PkgRepo: verifying update for pfSense-core
DBG(1)[49613]> PkgRepo: need forced update of pfSense-core
DBG(1)[49613]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense-core.sqlite'
DBG(1)[49613]> Request to fetch pkg+https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf
DBG(1)[49613]> opening libfetch fetcher
DBG(1)[49613]> Fetch > libfetch: connecting
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf with opts "i4"
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf with opts "i4"
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf with opts "i4"
DBG(1)[49613]> Request to fetch pkg+https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz
DBG(1)[49613]> opening libfetch fetcher
DBG(1)[49613]> Fetch > libfetch: connecting
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz with opts "i4"
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz with opts "i4"
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz with opts "i4"
pkg-static: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz: Permission denied
repository pfSense-core has no meta file, using default settings
DBG(1)[49613]> Request to fetch pkg+https://packages.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.pkg
DBG(1)[49613]> opening libfetch fetcher
DBG(1)[49613]> Fetch > libfetch: connecting
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.pkg with opts "i4"
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.pkg with opts "i4"
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.pkg with opts "i4"
pkg-static: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.pkg: Permission denied
DBG(1)[49613]> Request to fetch pkg+https://packages.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.txz
DBG(1)[49613]> opening libfetch fetcher
DBG(1)[49613]> Fetch > libfetch: connecting
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.txz with opts "i4"
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.txz with opts "i4"
DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.txz with opts "i4"
pkg-static: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/packagesite.txz: Permission denied

.......
Error updating repositories!

stephenw10 · Jun 21, 2023, 12:42 PM

Aha! Well that is almost always something blocking it.

Are you running Snort or Suricata? pfBlocker maybe? Check it's not blocking that traffic.

mrrobot · Jun 21, 2023, 12:46 PM

@stephenw10 i had to google all this tools to know about em, i don't have any of these
the router had only the os installed, i have been unable to install nothing else

mrrobot · Jun 21, 2023, 12:50 PM

@stephenw10

[2.6.0-RELEASE][admin@pfSense.xxxx.local]/root: pkg info | grep 'snort|suricata|pfb'
[2.6.0-RELEASE][admin@pfSense.xxxx.local]/root:

stephenw10 · Jun 21, 2023, 12:50 PM

Something is blocking it. Do you see anything in the firewall logs?

mrrobot · Jun 21, 2023, 12:53 PM

@stephenw10 i see the same log repeating over & over

login-to-view

stephenw10 · Jun 21, 2023, 1:00 PM

Is your WAN using a private IP?

If not what is that rule? Is that something you added?

Do you see the TCP traffic from pkg blocked there also?

mrrobot · Jun 21, 2023, 1:00 PM

@stephenw10 said in can't update pfsense or install packages:

is your WAN using a private IP?

yes, its 10.x.x.x

mrrobot · Jun 21, 2023, 1:05 PM

@stephenw10 said in can't update pfsense or install packages:

Do you see the TCP traffic from pkg blocked there also?

where ?

stephenw10 · Jun 21, 2023, 1:12 PM

In the firewall log.

However if you have added block rules on WAN or floating they may not be set to log. Have you added rules there?

mrrobot · Jun 21, 2023, 1:16 PM

@stephenw10 i have no block rule on WAN interface

login-to-view

in the log i see ICMP traffic blocked not TCP

login-to-view

stephenw10 · Jun 21, 2023, 1:24 PM

Those ping blocks are frequent. Were you running pkg update at the time to generate some tcp traffic.

Also they are shown blocked from the WAN IP to the gateway but not shown as outbound....

Do you have any rules on the floating tab?

You also have a pass all IPv4 rule on WAN which is almost always a bad idea. I assume you added that just as a test.

mrrobot · Jun 21, 2023, 1:25 PM

@stephenw10 said in can't update pfsense or install packages:

Those ping blocks are frequent. Were you running pkg update at the time to generate some tcp traffic.

yes i did run pkg update

mrrobot · Jun 21, 2023, 1:27 PM

@stephenw10 said in can't update pfsense or install packages:

Do you have any rules on the floating tab?

no, its empty

mrrobot · Jun 21, 2023, 1:31 PM

@stephenw10 said in can't update pfsense or install packages:

You also have a pass all IPv4 rule on WAN which is almost always a bad idea. I assume you added that just as a test.

yes i will chage it later once my issue is solved, i hope :)

stephenw10 · Jun 21, 2023, 1:41 PM

Ok, check the ruleset file /tmp/rules.debug

What is rule 12001 there?

That traffic should not be coming into WAN.

mrrobot · Jun 21, 2023, 2:14 PM

@stephenw10 i see no 12001 role in /tmp/rules.debug

[2.6.0-RELEASE][admin@pfSense.xxx.local]/root: grep '12001' /tmp/rules.debug
[2.6.0-RELEASE][admin@pfSense.xxx.local]/root:

mrrobot · Jun 21, 2023, 2:17 PM

@mrrobot i see a icmpv6 section thought, can't see icmp v4

.# Allow only bare essential icmpv6 packets (NS, NA, and RA, echoreq, echorep)
pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {129,133,134,135,136} ridentifier 1000000108 keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type {129,133,134,135,136} ridentifier 1000000109 keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {128,133,134,135,136} ridentifier 1000000110 keep state
pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type {128,133,134,135,136} ridentifier 1000000111 keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type {128,133,134,135,136} ridentifier 1000000112 keep state
pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type {128,133,134,135,136} ridentifier 1000000113 keep state
.# We use the mighty pf, we cannot be fooled.
block log quick inet proto { tcp, udp } from any port = 0 to any ridentifier 1000000114 label "Block traffic from port 0"
block log quick inet proto { tcp, udp } from any to any port = 0 ridentifier 1000000115 label "Block traffic to port 0"
block log quick inet6 proto { tcp, udp } from any port = 0 to any ridentifier 1000000116 label "Block traffic from port 0"
block log quick inet6 proto { tcp, udp } from any to any port = 0 ridentifier 1000000117 label "Block traffic to port 0"

stephenw10 · Jun 21, 2023, 2:43 PM

Ok try this. Click on the red X in the firewall log. What rule does it show has blocked that?