can't update pfsense or install packages

pokrifchakd

@stephenw10 said in can't update pfsense or install packages:

pkg-static -d update

I'm having a similar issue trying to update a pfSense+ VM. I've tried the following, based upon this thread.

[23.05.1-RELEASE][admin@chimera.ad.homeworldsolutions.com]/root: host pkg00-atx.netgate.com
pkg00-atx.netgate.com has address 208.123.73.207
pkg00-atx.netgate.com has IPv6 address 2610:160:11:18::207
[23.05.1-RELEASE][admin@chimera.ad.homeworldsolutions.com]/root: route -n get pkg00-atx.netgate.com
   route to: 208.123.73.207
destination: 0.0.0.0
       mask: 0.0.0.0
    gateway: 192.168.7.1
        fib: 0
  interface: vmx2
      flags: <UP,GATEWAY,DONE,STATIC>
 recvpipe  sendpipe  ssthresh  rtt,msec    mtu        weight    expire
       0         0         0         0      1500         1         0 
[23.05.1-RELEASE][admin@chimera.ad.homeworldsolutions.com]/root: route -n get pkg00-atx.netgate.com
   route to: 208.123.73.207
destination: 0.0.0.0
       mask: 0.0.0.0
    gateway: 192.168.7.1
        fib: 0
  interface: vmx2
      flags: <UP,GATEWAY,DONE,STATIC>
 recvpipe  sendpipe  ssthresh  rtt,msec    mtu        weight    expire
       0         0         0         0      1500         1         0 
[23.05.1-RELEASE][admin@chimera.ad.homeworldsolutions.com]/root: route -n -6 get pkg00-atx.netgate.com
route: route has not been found
[23.05.1-RELEASE][admin@chimera.ad.homeworldsolutions.com]/root: nc -vz pkg00-atx.netgate.com 443
Connection to pkg00-atx.netgate.com 443 port [tcp/https] succeeded!
[23.05.1-RELEASE][admin@chimera.ad.homeworldsolutions.com]/root: nc -vz4 pkg00-atx.netgate.com 443
Connection to pkg00-atx.netgate.com 443 port [tcp/https] succeeded!
[23.05.1-RELEASE][admin@chimera.ad.homeworldsolutions.com]/root: nc -vz6 pkg00-atx.netgate.com 443
nc: connect to pkg00-atx.netgate.com port 443 (tcp) failed: No route to host
[23.05.1-RELEASE][admin@chimera.ad.homeworldsolutions.com]/root: pkg-static -d update
DBG(1)[62290]> pkg initialized
Updating pfSense-core repository catalogue...
DBG(1)[62290]> PkgRepo: verifying update for pfSense-core
DBG(1)[62290]> PkgRepo: need forced update of pfSense-core
DBG(1)[62290]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense-core.sqlite'
DBG(1)[62290]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.conf
DBG(1)[62290]> opening libfetch fetcher
DBG(1)[62290]> Fetch > libfetch: connecting
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.conf with opts "i"

DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.conf with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.conf with opts "i"
DBG(1)[62290]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz
DBG(1)[62290]> opening libfetch fetcher
DBG(1)[62290]> Fetch > libfetch: connecting
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz with opts "i"
pkg-static: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz: Bad Request
repository pfSense-core has no meta file, using default settings
DBG(1)[62290]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg
DBG(1)[62290]> opening libfetch fetcher
DBG(1)[62290]> Fetch > libfetch: connecting
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg with opts "i"
pkg-static: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg: Bad Request
DBG(1)[62290]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz
DBG(1)[62290]> opening libfetch fetcher
DBG(1)[62290]> Fetch > libfetch: connecting
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz with opts "i"
pkg-static: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz: Bad Request
Unable to update repository pfSense-core
Updating pfSense repository catalogue...
DBG(1)[62290]> PkgRepo: verifying update for pfSense
DBG(1)[62290]> PkgRepo: need forced update of pfSense
DBG(1)[62290]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense.sqlite'
DBG(1)[62290]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.conf
DBG(1)[62290]> opening libfetch fetcher
DBG(1)[62290]> Fetch > libfetch: connecting
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.conf with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.conf with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.conf with opts "i"
DBG(1)[62290]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz
DBG(1)[62290]> opening libfetch fetcher
DBG(1)[62290]> Fetch > libfetch: connecting
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz with opts "i"
pkg-static: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz: Bad Request
repository pfSense has no meta file, using default settings
DBG(1)[62290]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg
DBG(1)[62290]> opening libfetch fetcher
DBG(1)[62290]> Fetch > libfetch: connecting
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg with opts "i"
pkg-static: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg: Bad Request
DBG(1)[62290]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz
DBG(1)[62290]> opening libfetch fetcher
DBG(1)[62290]> Fetch > libfetch: connecting
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz with opts "i"
DBG(1)[62290]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz with opts "i"
pkg-static: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz: Bad Request
Unable to update repository pfSense
Error updating repositories!

I'm not sure if the "Bad Request" errors are files missing from the repo, or something else. This has been ongoing for at least the last week. Like the OP, I'm trying to get several packages installed.

stephenw10

The 'Bad Request' error means your client is sending an invalid cert (or no cert). Try running pfSense-repoc first, that should pull a new cert.

If it still fails your NDI may have changed. Send it to me in chat and I can check it.

pokrifchakd

@stephenw10 That seems to have failed as well.

[23.05.1-RELEASE][admin@chimera.ad.homeworldsolutions.com]/root: pfSense-repoc
pfSense-repoc: invalid signature
failed to read the repo data.

stephenw10

Then send me your NDI in chat an I'll check it.

mrrobot

@stephenw10 no address record

[2.6.0-RELEASE][admin@pfSense.bigeyesbeats.local]/root: pkg-static -d update
DBG(1)[34414]> pkg initialized
Updating pfSense-core repository catalogue...
DBG(1)[34414]> PkgRepo: verifying update for pfSense-core
DBG(1)[34414]> PkgRepo: need forced update of pfSense-core
DBG(1)[34414]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense-core.sqlite'
DBG(1)[34414]> Request to fetch pkg+https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf
DBG(1)[34414]> opening libfetch fetcher
DBG(1)[34414]> Fetch > libfetch: connecting
DBG(1)[34414]> Fetch: fetching from: https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf with opts "i"
DBG(1)[34414]> Fetch: fetching from: https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf with opts "i"
DBG(1)[34414]> Fetch: fetching from: https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.conf with opts "i"
DBG(1)[34414]> Request to fetch pkg+https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz
DBG(1)[34414]> opening libfetch fetcher
DBG(1)[34414]> Fetch > libfetch: connecting
DBG(1)[34414]> Fetch: fetching from: https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz with opts "i"
DBG(1)[34414]> Fetch: fetching from: https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz with opts "i"
DBG(1)[34414]> Fetch: fetching from: https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz with opts "i"
pkg-static: https://packages.netgate.com/pfSense_v2_6_0_amd64-core/meta.txz: No address record

stephenw10

Hmm, so back to the initial error then?

You've had three separate errors here.
What changed to get back to the first error? Can you resolve things locally? Are you running Unbound in resolving mode without DoT?

mrrobot

@stephenw10 nothing to my knowledge

stephenw10

Spontaneously producing three different failure types has pretty much got to be something upstream changing the connection.

Leonardo 5

Oh my God, you don't know how many hours it took me to find a solution. I was getting that "no route to host" and "no address record" error on updating packages and it was solved when I changed the DNS Resolution Behaviour to "Use remote DNS Servers, ignore local DNS".

Leonardo 5

The problem was solved temporarily, now the situation is the same as before, I didn't change anything. I was able to run the pkg-static -d update, but now it is showing "no route to host" again and I can not download packages.

Running "nc -vz4 pkg00-atx.netgate.com 443" gives me the following result:
connect to pkg00-atx.netgate.com port 443 (tcp) failed: Can't assign requested address

stephenw10

Does it actually have a route? IPv4?

'Can't assign address' seems more like a conflict somewhere.

Leonardo 5

@stephenw10 It has a route.
179.16.0.1 is a mikrotik router, we are using it only for WAN connection, it doesn't have any special configuration. 179.16.0.4 is the PfSense LAN IP.

When I run traceroute on pkg01-atx.netgate.com, it shows:
1 179.16.0.1 0.323 ms 0.174 ms 0.200 ms
2 X.X.X.254 0.451 ms 0.672 ms 1.015 ms
3 Y.Y.Y.41 1.147 ms 0.848 ms 0.995 ms
4 A.A.A.213 2.372 ms 1.907 ms 1.979 ms
5 * * *
6 62.115.164.218 82.134 ms 81.618 ms 81.608 ms
7 * * *
8 * * *
9 4.14.49.2 117.047 ms 117.061 ms 117.034 ms
10 64.20.229.166 117.057 ms 116.926 ms 117.031 ms
11 66.219.34.198 116.789 ms 116.812 ms
66.219.34.194 117.138 ms
12 208.123.73.4 117.534 ms 117.299 ms 117.631 ms
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *

It seems that looking at the route it does not reach the destination point. But I find it strange, because I can ping.
PING pkg01-atx.netgate.com (208.123.73.209): 56 data bytes
64 bytes from 208.123.73.209: icmp_seq=0 ttl=50 time=117.575 ms
64 bytes from 208.123.73.209: icmp_seq=1 ttl=50 time=117.406 ms
64 bytes from 208.123.73.209: icmp_seq=2 ttl=50 time=117.492 ms

--- pkg01-atx.netgate.com ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 117.406/117.491/117.575/0.069 ms

stephenw10

Use ICMP traceroute like: traceroute -In pkg01-atx.netgate.com

Leonardo 5

@stephenw10 traceroute -In pkg01-atx.netgate.com result:
traceroute to pkg01-atx.netgate.com (208.123.73.209), 64 hops max, 48 byte packets
1 179.16.0.1 0.402 ms 1.035 ms 0.310 ms
2 X.X.X.254 1.407 ms 0.476 ms 0.777 ms
3 Y.Y.Y.41 1.907 ms 0.760 ms 0.986 ms
4 * * *
5 * * *
6 62.115.164.218 82.548 ms 81.724 ms 82.015 ms
7 * * *
8 * * *
9 4.14.49.2 118.087 ms 117.059 ms 116.963 ms
10 64.20.229.158 117.777 ms 117.279 ms 117.157 ms
11 66.219.34.194 117.218 ms 117.743 ms 116.793 ms
12 208.123.73.4 118.006 ms 117.298 ms 118.029 ms
13 208.123.73.209 117.889 ms 117.300 ms 117.119 ms

stephenw10

But you're still seeing 'no route to host' in the output of: pkg-static -d update ?

Leonardo 5

@stephenw10 Yes. And I can not see/download packages.

On running pkg-static -d update:
DBG(1)[97999]> pkg initialized
Updating pfSense-core repository catalogue...
DBG(1)[97999]> PkgRepo: verifying update for pfSense-core
DBG(1)[97999]> PkgRepo: need forced update of pfSense-core
DBG(1)[97999]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense-core.sqlite'
DBG(1)[97999]> Request to fetch pkg+https://pkg.pfsense.org/pfSense_v2_7_0_amd64-core/meta.conf
DBG(1)[97999]> opening libfetch fetcher
DBG(1)[97999]> Fetch > libfetch: connecting
DBG(1)[97999]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_7_0_amd64-core/meta.conf with opts "i"
DBG(1)[97999]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_7_0_amd64-core/meta.conf with opts "i"
DBG(1)[97999]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_7_0_amd64-core/meta.conf with opts "i"
DBG(1)[97999]> Request to fetch pkg+https://pkg.pfsense.org/pfSense_v2_7_0_amd64-core/meta.txz
DBG(1)[97999]> opening libfetch fetcher
DBG(1)[97999]> Fetch > libfetch: connecting
DBG(1)[97999]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_7_0_amd64-core/meta.txz with opts "i"
DBG(1)[97999]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_7_0_amd64-core/meta.txz with opts "i"
DBG(1)[97999]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_7_0_amd64-core/meta.txz with opts "i"
pkg-static: https://pkg01-atx.netgate.com/pfSense_v2_7_0_amd64-core/meta.txz: No route to host
repository pfSense-core has no meta file, using default settings
...
DBG(1)[97999]> Request to fetch pkg+https://pkg.pfsense.org/pfSense_v2_7_0_amd64-pfSense_v2_7_0/packagesite.txz
DBG(1)[97999]> opening libfetch fetcher
DBG(1)[97999]> Fetch > libfetch: connecting
DBG(1)[97999]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_7_0_amd64-pfSense_v2_7_0/packagesite.txz with opts "i"
DBG(1)[97999]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_7_0_amd64-pfSense_v2_7_0/packagesite.txz with opts "i"
DBG(1)[97999]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_7_0_amd64-pfSense_v2_7_0/packagesite.txz with opts "i"
pkg-static: https://pkg00-atx.netgate.com/pfSense_v2_7_0_amd64-pfSense_v2_7_0/packagesite.txz: No route to host
Unable to update repository pfSense
Error updating repositories!

stephenw10

Hmm, try: pkg-static -d4 update

Leonardo 5

When I changed DNS Resolution Behavior to "Use remote DNS Servers, ignore local DNS" I was able to see the packages and run "pkg-static -d update".
I even tried to install the open vpn config export package, but I got an error asking to update pfsense.
It was only normal for about 10 minutes, then when I tried to update pfSense it was back to the same problem as before, "no route to host".

Leonardo 5

@stephenw10 Running pkg-static -d4 update
...
DBG(1)[10184]> Request to fetch pkg+https://pkg.pfsense.org/pfSense_v2_7_0_amd64-pfSense_v2_7_0/packagesite.txz
DBG(1)[10184]> opening libfetch fetcher
DBG(1)[10184]> Fetch > libfetch: connecting
DBG(1)[10184]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_7_0_amd64-pfSense_v2_7_0/packagesite.txz with opts "i4"
DBG(1)[10184]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_7_0_amd64-pfSense_v2_7_0/packagesite.txz with opts "i4"
DBG(1)[10184]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_7_0_amd64-pfSense_v2_7_0/packagesite.txz with opts "i4"
pkg-static: https://pkg01-atx.netgate.com/pfSense_v2_7_0_amd64-pfSense_v2_7_0/packagesite.txz: Permission denied
Unable to update repository pfSense
Error updating repositories!

stephenw10

Ok so it looks like it's trying to use v6 by default but there's no route. And something is blocking it when it tries to use v4.

Are you logged in as admin/root?

Do you have outbound block rules? pfBlocker? Snort?