can't update pfsense or install packages

[mrrobot]

@stephenw10 i just rebooted the router but nothing changes

[stephenw10]

So you have those aliases but never used them in a firewall rule?

Do you have an upstream proxy configured?

[mrrobot]

@stephenw10 said in can't update pfsense or install packages:

So you have those aliases but never used them in a firewall rule?

yes

[mrrobot]

@stephenw10 said in can't update pfsense or install packages:

Do you have an upstream proxy configured?

no

[stephenw10]

Ok try this. At the CLI run:

pfctl -d

That will disable the firewall entirely.
Then try to update again:

pkg-static -d update

Re-enable the firewall again:

pfctl -e

[mrrobot]

@stephenw10 i lost internet completely when i desabled the firewall

[stephenw10]

You would lose it from a client behind the firewall because it also disables NAT but does it allow the firewall to connect to the package servers?

[mrrobot]

@stephenw10 no the firewall update status keeps looking in the dashboard
tired the update from command prompt, no success
package manager is unable to connect to servers

[stephenw10]

Does it still show 'permission denied' though with the firewall disabled?

[mrrobot]

@stephenw10 permission denied where ?

[stephenw10]

When you run pkg-static -d update.

Previously you were seeing:

DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz with opts "i4"
pkg-static: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz: Permission denied

And similarly in the netcat test:

$nc -vz4 pkg00-atx.netgate.com 443
	nc: connect to pkg00-atx.netgate.com port 443 (tcp) failed: Permission denied

Since it can't create states locally it must be something on the firewall doing that.
So if we disable pf and it still shows that error that means it must be something other than pf. Which in 2.6 could really only be ipfw.
But that's only used in the Captive Portal and for Limiters.
So since you're not using Captive Portal, do you have Limiters defined? I don't see any rules passing traffic into pipes if you do.

[mrrobot]

@stephenw10 said in can't update pfsense or install packages:

nc -vz4 pkg00-atx.netgate.com 443

after disabling pf i got this

[2.6.0-RELEASE][admin@pfSense.xxx.local]/root: pkg-static -d update
DBG(1)[55352]> pkg initialized
Updating pfSense-core repository catalogue...
DBG(1)[55352]> PkgRepo: verifying update for pfSense-core
DBG(1)[55352]> PkgRepo: need forced update of pfSense-core
DBG(1)[55352]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense-core.sqlite'
DBG(1)[55352]> Request to fetch pkg+https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf
DBG(1)[55352]> opening libfetch fetcher
DBG(1)[55352]> Fetch > libfetch: connecting
DBG(1)[55352]> Fetch: fetching from: https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf with opts "i"
DBG(1)[55352]> Fetch: fetching from: https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf with opts "i"
DBG(1)[55352]> Fetch: fetching from: https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf with opts "i"
DBG(1)[55352]> Request to fetch pkg+https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz
DBG(1)[55352]> opening libfetch fetcher
DBG(1)[55352]> Fetch > libfetch: connecting
DBG(1)[55352]> Fetch: fetching from: https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz with opts "i"
DBG(1)[55352]> Fetch: fetching from: https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz with opts "i"
^C

2.6.0-RELEASE][admin@pfSense.xxx.local]/root: nc -vz4 pkg00-atx.netgate.com 443
nc: getaddrinfo: Name does not resolve

[stephenw10]

Ok so a DNS issue. For v4 at least

How is the sytem DNS configured in general setup?

[mrrobot]

@stephenw10 im using a local pihole server, but i did try google & cloudflare dns servers with no luck
do you want me to run some tests ?

[stephenw10]

Yes, some testing is needed in pfSense.

But first confirm how pfSense is configured for DNS in General Setup. Is it using only the pihole?

[mrrobot]

@stephenw10 sorry for the late responce, yes under "system / general setup" i have set up one dns server (my local pi-hole)

[stephenw10]

But what is 'DNS Resolution Behavior' set to? Is it actually using the configured server? By default it will only use that if Unbound doesn't reply on localhost.

[mrrobot]

@stephenw10

[stephenw10]

Ok, so it's trying to use localhost (Unbound). It should fall back to the pihole if that fails but try setting that to 'Use remote DNS servers' and see if that changes anything.

[Nibblet]

Don't know if it helps, but both your LAN and your WAN appear to be using addresses out of the 10/8 range, and depending on how you have set your network up you might have some weird routing going on - this can lead to errors such as route unreachable.

As a start I'd maybe consider renumbering your internal network so it is guaranteed to not use ranges that may be on the WAN side of the network - maybe like 172.20.0.0/16 or something.