Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    can't update pfsense or install packages

    Scheduled Pinned Locked Moved General pfSense Questions
    148 Posts 9 Posters 27.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mrrobot @stephenw10
      last edited by

      @stephenw10 no the firewall update status keeps looking in the dashboard
      tired the update from command prompt, no success
      package manager is unable to connect to servers

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Does it still show 'permission denied' though with the firewall disabled?

        M 1 Reply Last reply Reply Quote 0
        • M
          mrrobot @stephenw10
          last edited by

          @stephenw10 permission denied where ?

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            When you run pkg-static -d update.

            Previously you were seeing:

            DBG(1)[49613]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz with opts "i4"
pkg-static: https://pkg00-atx.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz: Permission denied

            And similarly in the netcat test:

            $nc -vz4 pkg00-atx.netgate.com 443
	nc: connect to pkg00-atx.netgate.com port 443 (tcp) failed: Permission denied

            Since it can't create states locally it must be something on the firewall doing that.
            So if we disable pf and it still shows that error that means it must be something other than pf. Which in 2.6 could really only be ipfw.
            But that's only used in the Captive Portal and for Limiters.
            So since you're not using Captive Portal, do you have Limiters defined? I don't see any rules passing traffic into pipes if you do.

            M 1 Reply Last reply Reply Quote 0
            • M
              mrrobot @stephenw10
              last edited by

              @stephenw10 said in can't update pfsense or install packages:

              nc -vz4 pkg00-atx.netgate.com 443

              after disabling pf i got this

              [2.6.0-RELEASE][admin@pfSense.xxx.local]/root: pkg-static -d update
DBG(1)[55352]> pkg initialized
Updating pfSense-core repository catalogue...
DBG(1)[55352]> PkgRepo: verifying update for pfSense-core
DBG(1)[55352]> PkgRepo: need forced update of pfSense-core
DBG(1)[55352]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense-core.sqlite'
DBG(1)[55352]> Request to fetch pkg+https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf
DBG(1)[55352]> opening libfetch fetcher
DBG(1)[55352]> Fetch > libfetch: connecting
DBG(1)[55352]> Fetch: fetching from: https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf with opts "i"
DBG(1)[55352]> Fetch: fetching from: https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf with opts "i"
DBG(1)[55352]> Fetch: fetching from: https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf with opts "i"
DBG(1)[55352]> Request to fetch pkg+https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz
DBG(1)[55352]> opening libfetch fetcher
DBG(1)[55352]> Fetch > libfetch: connecting
DBG(1)[55352]> Fetch: fetching from: https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz with opts "i"
DBG(1)[55352]> Fetch: fetching from: https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz with opts "i"
^C

              2.6.0-RELEASE][admin@pfSense.xxx.local]/root: nc -vz4 pkg00-atx.netgate.com 443
nc: getaddrinfo: Name does not resolve
              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                Ok so a DNS issue. For v4 at least

                How is the sytem DNS configured in general setup?

                M 1 Reply Last reply Reply Quote 0
                • M
                  mrrobot @stephenw10
                  last edited by

                  @stephenw10 im using a local pihole server, but i did try google & cloudflare dns servers with no luck
                  do you want me to run some tests ?

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Yes, some testing is needed in pfSense.

                    But first confirm how pfSense is configured for DNS in General Setup. Is it using only the pihole?

                    M 1 Reply Last reply Reply Quote 0
                    • M
                      mrrobot @stephenw10
                      last edited by

                      @stephenw10 sorry for the late responce, yes under "system / general setup" i have set up one dns server (my local pi-hole)

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        But what is 'DNS Resolution Behavior' set to? Is it actually using the configured server? By default it will only use that if Unbound doesn't reply on localhost.

                        M 1 Reply Last reply Reply Quote 0
                        • M
                          mrrobot @stephenw10
                          last edited by mrrobot

                          @stephenw10
                          Screenshot 2023-07-04 at 20.01.50.png

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Ok, so it's trying to use localhost (Unbound). It should fall back to the pihole if that fails but try setting that to 'Use remote DNS servers' and see if that changes anything.

                            M 1 Reply Last reply Reply Quote 0
                            • N
                              Nibblet
                              last edited by

                              Don't know if it helps, but both your LAN and your WAN appear to be using addresses out of the 10/8 range, and depending on how you have set your network up you might have some weird routing going on - this can lead to errors such as route unreachable.

                              As a start I'd maybe consider renumbering your internal network so it is guaranteed to not use ranges that may be on the WAN side of the network - maybe like 172.20.0.0/16 or something.

                              M 1 Reply Last reply Reply Quote 2
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Both are in 10/8 but they are not conflicting. The LAN is /24 and the WAN is a /32 (ptp) outside that /24.

                                1 Reply Last reply Reply Quote 0
                                • M
                                  mrrobot @stephenw10
                                  last edited by

                                  @stephenw10 alredy tried to use remote but still same issue, i tried again rn with no succes

                                  M 1 Reply Last reply Reply Quote 0
                                  • M
                                    mrrobot @Nibblet
                                    last edited by

                                    @Nibblet i'll give it a try this weekend

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      mrrobot @mrrobot
                                      last edited by

                                      @mrrobot anything else we can try ?

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Are you still seeing the same 'permission denied' errors?

                                        M 1 Reply Last reply Reply Quote 0
                                        • P
                                          pokrifchakd
                                          last edited by

                                          @stephenw10 said in can't update pfsense or install packages:

                                          pkg-static -d update

                                          I'm having a similar issue trying to update a pfSense+ VM. I've tried the following, based upon this thread.

                                          [23.05.1-RELEASE][admin@chimera.ad.homeworldsolutions.com]/root: host pkg00-atx.netgate.com
pkg00-atx.netgate.com has address 208.123.73.207
pkg00-atx.netgate.com has IPv6 address 2610:160:11:18::207
[23.05.1-RELEASE][admin@chimera.ad.homeworldsolutions.com]/root: route -n get pkg00-atx.netgate.com
   route to: 208.123.73.207
destination: 0.0.0.0
       mask: 0.0.0.0
    gateway: 192.168.7.1
        fib: 0
  interface: vmx2
      flags: <UP,GATEWAY,DONE,STATIC>
 recvpipe  sendpipe  ssthresh  rtt,msec    mtu        weight    expire
       0         0         0         0      1500         1         0 
[23.05.1-RELEASE][admin@chimera.ad.homeworldsolutions.com]/root: route -n get pkg00-atx.netgate.com
   route to: 208.123.73.207
destination: 0.0.0.0
       mask: 0.0.0.0
    gateway: 192.168.7.1
        fib: 0
  interface: vmx2
      flags: <UP,GATEWAY,DONE,STATIC>
 recvpipe  sendpipe  ssthresh  rtt,msec    mtu        weight    expire
       0         0         0         0      1500         1         0 
[23.05.1-RELEASE][admin@chimera.ad.homeworldsolutions.com]/root: route -n -6 get pkg00-atx.netgate.com
route: route has not been found
[23.05.1-RELEASE][admin@chimera.ad.homeworldsolutions.com]/root: nc -vz pkg00-atx.netgate.com 443
Connection to pkg00-atx.netgate.com 443 port [tcp/https] succeeded!
[23.05.1-RELEASE][admin@chimera.ad.homeworldsolutions.com]/root: nc -vz4 pkg00-atx.netgate.com 443
Connection to pkg00-atx.netgate.com 443 port [tcp/https] succeeded!
[23.05.1-RELEASE][admin@chimera.ad.homeworldsolutions.com]/root: nc -vz6 pkg00-atx.netgate.com 443
nc: connect to pkg00-atx.netgate.com port 443 (tcp) failed: No route to host
[23.05.1-RELEASE][admin@chimera.ad.homeworldsolutions.com]/root: pkg-static -d update
DBG(1)[62290]> pkg initialized
Updating pfSense-core repository catalogue...
DBG(1)[62290]> PkgRepo: verifying update for pfSense-core
DBG(1)[62290]> PkgRepo: need forced update of pfSense-core
DBG(1)[62290]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense-core.sqlite'
DBG(1)[62290]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.conf
DBG(1)[62290]> opening libfetch fetcher
DBG(1)[62290]> Fetch > libfetch: connecting
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.conf with opts "i"

DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.conf with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.conf with opts "i"
DBG(1)[62290]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz
DBG(1)[62290]> opening libfetch fetcher
DBG(1)[62290]> Fetch > libfetch: connecting
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz with opts "i"
pkg-static: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz: Bad Request
repository pfSense-core has no meta file, using default settings
DBG(1)[62290]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg
DBG(1)[62290]> opening libfetch fetcher
DBG(1)[62290]> Fetch > libfetch: connecting
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg with opts "i"
pkg-static: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg: Bad Request
DBG(1)[62290]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz
DBG(1)[62290]> opening libfetch fetcher
DBG(1)[62290]> Fetch > libfetch: connecting
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz with opts "i"
pkg-static: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz: Bad Request
Unable to update repository pfSense-core
Updating pfSense repository catalogue...
DBG(1)[62290]> PkgRepo: verifying update for pfSense
DBG(1)[62290]> PkgRepo: need forced update of pfSense
DBG(1)[62290]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense.sqlite'
DBG(1)[62290]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.conf
DBG(1)[62290]> opening libfetch fetcher
DBG(1)[62290]> Fetch > libfetch: connecting
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.conf with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.conf with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.conf with opts "i"
DBG(1)[62290]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz
DBG(1)[62290]> opening libfetch fetcher
DBG(1)[62290]> Fetch > libfetch: connecting
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz with opts "i"
pkg-static: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz: Bad Request
repository pfSense has no meta file, using default settings
DBG(1)[62290]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg
DBG(1)[62290]> opening libfetch fetcher
DBG(1)[62290]> Fetch > libfetch: connecting
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg with opts "i"
pkg-static: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg: Bad Request
DBG(1)[62290]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz
DBG(1)[62290]> opening libfetch fetcher
DBG(1)[62290]> Fetch > libfetch: connecting
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz with opts "i"
pkg-static: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz: Bad Request
Unable to update repository pfSense
Error updating repositories!

                                          I'm not sure if the "Bad Request" errors are files missing from the repo, or something else. This has been ongoing for at least the last week. Like the OP, I'm trying to get several packages installed.

                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            The 'Bad Request' error means your client is sending an invalid cert (or no cert). Try running pfSense-repoc first, that should pull a new cert.

                                            If it still fails your NDI may have changed. Send it to me in chat and I can check it.

                                            P 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.