can't update pfsense or install packages

[stephenw10]

So still no states. Something is preventing it open states locally.

Do you have captive portal running?

[mrrobot]

@stephenw10 sorry for the late respond ! no captive portal is not active

[stephenw10]

To confirm you are looking at the states correctly try running a port test against something else and then looking for those states.
For example 1.1.1.1:

[mrrobot]

@stephenw10 here are the results

[jimp]

From a shell prompt or Diag > Command (preferably a shell prompt), try running the following commands:

$ host pkg00-atx.netgate.com
$ route -n get pkg00-atx.netgate.com
$ route -n -4 get pkg00-atx.netgate.com
$ route -n -6 get pkg00-atx.netgate.com
$ nc -vz pkg00-atx.netgate.com 443
$ nc -vz4 pkg00-atx.netgate.com 443
$ nc -vz6 pkg00-atx.netgate.com 443

On a working system with IPv4 and IPv6 connectivity, I'd expect to see the following output:

$ host pkg00-atx.netgate.com
pkg00-atx.netgate.com has address 208.123.73.207
pkg00-atx.netgate.com has IPv6 address 2610:160:11:18::207
$ route -n get pkg00-atx.netgate.com
   route to: 208.123.73.207
destination: 0.0.0.0
       mask: 0.0.0.0
    gateway: x.x.x.1
        fib: 0
  interface: ix3
      flags: <UP,GATEWAY,DONE,STATIC>
 recvpipe  sendpipe  ssthresh  rtt,msec    mtu        weight    expire
       0         0         0         0      1500         1         0
$ route -n -4 get pkg00-atx.netgate.com
   route to: 208.123.73.207
destination: 0.0.0.0
       mask: 0.0.0.0
    gateway: x.x.x.1
        fib: 0
  interface: ix3
      flags: <UP,GATEWAY,DONE,STATIC>
 recvpipe  sendpipe  ssthresh  rtt,msec    mtu        weight    expire
       0         0         0         0      1500         1         0
$ route -n -6 get pkg00-atx.netgate.com
   route to: 2610:160:11:18::207
destination: ::
       mask: ::
    gateway: 2xxx:xxxx:xxxx:xxxx::1
        fib: 0
  interface: gif0
      flags: <UP,GATEWAY,DONE,STATIC>
 recvpipe  sendpipe  ssthresh  rtt,msec    mtu        weight    expire
       0         0         0         0      1480         1         0
$ nc -vz pkg00-atx.netgate.com 443
Connection to pkg00-atx.netgate.com 443 port [tcp/https] succeeded!
$ nc -vz4 pkg00-atx.netgate.com 443
Connection to pkg00-atx.netgate.com 443 port [tcp/https] succeeded!
$ nc -vz6 pkg00-atx.netgate.com 443
Connection to pkg00-atx.netgate.com 443 port [tcp/https] succeeded!

[mrrobot]

@jimp the first 3 cmds respond the same way as working system

the rest is below

$route -n -6 get pkg00-atx.netgate.com
	route: route has not been found
$nc -vz pkg00-atx.netgate.com 443
	nc: connect to pkg00-atx.netgate.com port 443 (tcp) failed: Permission denied
	nc: connect to pkg00-atx.netgate.com port 443 (tcp) failed: No route to host
$nc -vz4 pkg00-atx.netgate.com 443
	nc: connect to pkg00-atx.netgate.com port 443 (tcp) failed: Permission denied
$nc -vz6 pkg00-atx.netgate.com 443
	nc: connect to pkg00-atx.netgate.com port 443 (tcp) failed: No route to host

[jimp]

And you are certain there are no rules on the Floating tab?

If you run the command pfSsh.php playback pftabledrill from a shell prompt, do you see anything listed in the sshguard or virusprot tables?

[mrrobot]

@jimp

[jimp]

There has to be something in your rules blocking the outgoing connection then, but without a floating rule I'm not sure what it might be coming from. A package, possibly.

Can you post the whole /tmp/rules.debug file as a text attachment (e.g. rename it to rules.txt). You can edit out any sensitive IP addresses but please keep the last octet intact and differentiated. For example, you can change 192.168.1.1 to x.x.x.1 and 203.0.113.5 to y.y.y.5 so it's clear they're different subnets.

[stephenw10]

Yes, it has to be something blocking it locally. The firewall itself cannot create outbound states.

Do you have outbound NAT set to automatic? If not perhaps you have an overmatching rule doing something odd. That wasn't the same error you saw when it was trying IPv6...

[mrrobot]

@jimp rules.txt

[mrrobot]

@stephenw10 outbound NAT Mode is set to automatic

[stephenw10]

Did you ever have rules using those aliases for the Netgate repo servers?

Though you cant even open a state to 1.1.1.1.

Did you ever have Snort/Suricata installed?

[mrrobot]

@stephenw10 u mean aliases for netgate servers ? i don't remember
and i have never installed any package

[stephenw10]

Your config contains:

# User Aliases\
table <files01_netgate_com> \{   208.123.73.209/32  2610:160:11:18::209/128 \}\
files01_netgate_com = "<files01_netgate_com>"\
table <files00_netgate_com> \{   208.123.73.207/32  2610:160:11:18::207/128 \}\
files00_netgate_com = "<files00_netgate_com>"\
table <pkg01_atx_netgate_com> \{   208.123.73.209/32  2610:160:11:18::209/128 \}\
pkg01_atx_netgate_com = "<pkg01_atx_netgate_com>"\
table <pkg00_atx_netgate_com> \{   208.123.73.207/32  2610:160:11:18::207/128 \}\
pkg00_atx_netgate_com = "<pkg00_atx_netgate_com>"\

Those are user created but are not currently being used in the ruleset. If at any time they were used it's possible some old rule is somehow still loaded.

Can we assume you have rebooted at some point? That would clear any old rules.

[mrrobot]

@stephenw10 i just rebooted the router but nothing changes

[stephenw10]

So you have those aliases but never used them in a firewall rule?

Do you have an upstream proxy configured?

[mrrobot]

@stephenw10 said in can't update pfsense or install packages:

So you have those aliases but never used them in a firewall rule?

yes

[mrrobot]

@stephenw10 said in can't update pfsense or install packages:

Do you have an upstream proxy configured?

no

[stephenw10]

Ok try this. At the CLI run:

pfctl -d

That will disable the firewall entirely.
Then try to update again:

pkg-static -d update

Re-enable the firewall again:

pfctl -e