Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    can't update pfsense or install packages

    Scheduled Pinned Locked Moved General pfSense Questions
    148 Posts 9 Posters 33.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mrrobot @stephenw10
      last edited by

      @stephenw10 here are the results

      Screenshot 2023-06-22 at 20.45.02.png

      Screenshot 2023-06-22 at 20.45.46.png

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        From a shell prompt or Diag > Command (preferably a shell prompt), try running the following commands:

        $ host pkg00-atx.netgate.com
        $ route -n get pkg00-atx.netgate.com
        $ route -n -4 get pkg00-atx.netgate.com
        $ route -n -6 get pkg00-atx.netgate.com
        $ nc -vz pkg00-atx.netgate.com 443
        $ nc -vz4 pkg00-atx.netgate.com 443
        $ nc -vz6 pkg00-atx.netgate.com 443
        

        On a working system with IPv4 and IPv6 connectivity, I'd expect to see the following output:

        $ host pkg00-atx.netgate.com
        pkg00-atx.netgate.com has address 208.123.73.207
        pkg00-atx.netgate.com has IPv6 address 2610:160:11:18::207
        $ route -n get pkg00-atx.netgate.com
           route to: 208.123.73.207
        destination: 0.0.0.0
               mask: 0.0.0.0
            gateway: x.x.x.1
                fib: 0
          interface: ix3
              flags: <UP,GATEWAY,DONE,STATIC>
         recvpipe  sendpipe  ssthresh  rtt,msec    mtu        weight    expire
               0         0         0         0      1500         1         0
        $ route -n -4 get pkg00-atx.netgate.com
           route to: 208.123.73.207
        destination: 0.0.0.0
               mask: 0.0.0.0
            gateway: x.x.x.1
                fib: 0
          interface: ix3
              flags: <UP,GATEWAY,DONE,STATIC>
         recvpipe  sendpipe  ssthresh  rtt,msec    mtu        weight    expire
               0         0         0         0      1500         1         0
        $ route -n -6 get pkg00-atx.netgate.com
           route to: 2610:160:11:18::207
        destination: ::
               mask: ::
            gateway: 2xxx:xxxx:xxxx:xxxx::1
                fib: 0
          interface: gif0
              flags: <UP,GATEWAY,DONE,STATIC>
         recvpipe  sendpipe  ssthresh  rtt,msec    mtu        weight    expire
               0         0         0         0      1480         1         0
        $ nc -vz pkg00-atx.netgate.com 443
        Connection to pkg00-atx.netgate.com 443 port [tcp/https] succeeded!
        $ nc -vz4 pkg00-atx.netgate.com 443
        Connection to pkg00-atx.netgate.com 443 port [tcp/https] succeeded!
        $ nc -vz6 pkg00-atx.netgate.com 443
        Connection to pkg00-atx.netgate.com 443 port [tcp/https] succeeded!
        

        Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        M 1 Reply Last reply Reply Quote 0
        • M
          mrrobot @jimp
          last edited by

          @jimp the first 3 cmds respond the same way as working system

          the rest is below

          
          
          
          
          
          $route -n -6 get pkg00-atx.netgate.com
          	route: route has not been found
          $nc -vz pkg00-atx.netgate.com 443
          	nc: connect to pkg00-atx.netgate.com port 443 (tcp) failed: Permission denied
          	nc: connect to pkg00-atx.netgate.com port 443 (tcp) failed: No route to host
          $nc -vz4 pkg00-atx.netgate.com 443
          	nc: connect to pkg00-atx.netgate.com port 443 (tcp) failed: Permission denied
          $nc -vz6 pkg00-atx.netgate.com 443
          	nc: connect to pkg00-atx.netgate.com port 443 (tcp) failed: No route to host
          
          
          
          1 Reply Last reply Reply Quote 0
          • jimpJ
            jimp Rebel Alliance Developer Netgate
            last edited by

            And you are certain there are no rules on the Floating tab?

            If you run the command pfSsh.php playback pftabledrill from a shell prompt, do you see anything listed in the sshguard or virusprot tables?

            Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            M 1 Reply Last reply Reply Quote 0
            • M
              mrrobot @jimp
              last edited by

              @jimp Screenshot 2023-06-22 at 21.22.25.png
              Screenshot 2023-06-22 at 21.23.01.png

              1 Reply Last reply Reply Quote 0
              • jimpJ
                jimp Rebel Alliance Developer Netgate
                last edited by

                There has to be something in your rules blocking the outgoing connection then, but without a floating rule I'm not sure what it might be coming from. A package, possibly.

                Can you post the whole /tmp/rules.debug file as a text attachment (e.g. rename it to rules.txt). You can edit out any sensitive IP addresses but please keep the last octet intact and differentiated. For example, you can change 192.168.1.1 to x.x.x.1 and 203.0.113.5 to y.y.y.5 so it's clear they're different subnets.

                Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                Need help fast? Netgate Global Support!

                Do not Chat/PM for help!

                M 1 Reply Last reply Reply Quote 1
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  Yes, it has to be something blocking it locally. The firewall itself cannot create outbound states.

                  Do you have outbound NAT set to automatic? If not perhaps you have an overmatching rule doing something odd. That wasn't the same error you saw when it was trying IPv6...

                  M 1 Reply Last reply Reply Quote 0
                  • M
                    mrrobot @jimp
                    last edited by

                    @jimp rules.txt

                    1 Reply Last reply Reply Quote 0
                    • M
                      mrrobot @stephenw10
                      last edited by

                      @stephenw10 outbound NAT Mode is set to automatic

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Did you ever have rules using those aliases for the Netgate repo servers?

                        Though you cant even open a state to 1.1.1.1.

                        Did you ever have Snort/Suricata installed?

                        M 1 Reply Last reply Reply Quote 0
                        • M
                          mrrobot @stephenw10
                          last edited by

                          @stephenw10 u mean aliases for netgate servers ? i don't remember
                          and i have never installed any package

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Your config contains:

                            # User Aliases\
                            table <files01_netgate_com> \{   208.123.73.209/32  2610:160:11:18::209/128 \}\
                            files01_netgate_com = "<files01_netgate_com>"\
                            table <files00_netgate_com> \{   208.123.73.207/32  2610:160:11:18::207/128 \}\
                            files00_netgate_com = "<files00_netgate_com>"\
                            table <pkg01_atx_netgate_com> \{   208.123.73.209/32  2610:160:11:18::209/128 \}\
                            pkg01_atx_netgate_com = "<pkg01_atx_netgate_com>"\
                            table <pkg00_atx_netgate_com> \{   208.123.73.207/32  2610:160:11:18::207/128 \}\
                            pkg00_atx_netgate_com = "<pkg00_atx_netgate_com>"\
                            

                            Those are user created but are not currently being used in the ruleset. If at any time they were used it's possible some old rule is somehow still loaded.

                            Can we assume you have rebooted at some point? That would clear any old rules.

                            M 1 Reply Last reply Reply Quote 0
                            • M
                              mrrobot @stephenw10
                              last edited by

                              @stephenw10 i just rebooted the router but nothing changes

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                So you have those aliases but never used them in a firewall rule?

                                Do you have an upstream proxy configured?

                                M 2 Replies Last reply Reply Quote 0
                                • M
                                  mrrobot @stephenw10
                                  last edited by

                                  @stephenw10 said in can't update pfsense or install packages:

                                  So you have those aliases but never used them in a firewall rule?

                                  yes

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    mrrobot @stephenw10
                                    last edited by

                                    @stephenw10 said in can't update pfsense or install packages:

                                    Do you have an upstream proxy configured?

                                    no

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      Ok try this. At the CLI run:

                                      pfctl -d
                                      

                                      That will disable the firewall entirely.
                                      Then try to update again:

                                      pkg-static -d update
                                      

                                      Re-enable the firewall again:

                                      pfctl -e
                                      
                                      M 1 Reply Last reply Reply Quote 1
                                      • M
                                        mrrobot @stephenw10
                                        last edited by

                                        @stephenw10 i lost internet completely when i desabled the firewall

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          You would lose it from a client behind the firewall because it also disables NAT but does it allow the firewall to connect to the package servers?

                                          M 1 Reply Last reply Reply Quote 0
                                          • M
                                            mrrobot @stephenw10
                                            last edited by

                                            @stephenw10 no the firewall update status keeps looking in the dashboard
                                            tired the update from command prompt, no success
                                            package manager is unable to connect to servers

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.