can't update pfsense or install packages

[Leonardo 5]

When I changed DNS Resolution Behavior to "Use remote DNS Servers, ignore local DNS" I was able to see the packages and run "pkg-static -d update".
I even tried to install the open vpn config export package, but I got an error asking to update pfsense.
It was only normal for about 10 minutes, then when I tried to update pfSense it was back to the same problem as before, "no route to host".

[Leonardo 5]

@stephenw10 Running pkg-static -d4 update
...
DBG(1)[10184]> Request to fetch pkg+https://pkg.pfsense.org/pfSense_v2_7_0_amd64-pfSense_v2_7_0/packagesite.txz
DBG(1)[10184]> opening libfetch fetcher
DBG(1)[10184]> Fetch > libfetch: connecting
DBG(1)[10184]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_7_0_amd64-pfSense_v2_7_0/packagesite.txz with opts "i4"
DBG(1)[10184]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_7_0_amd64-pfSense_v2_7_0/packagesite.txz with opts "i4"
DBG(1)[10184]> Fetch: fetching from: https://pkg01-atx.netgate.com/pfSense_v2_7_0_amd64-pfSense_v2_7_0/packagesite.txz with opts "i4"
pkg-static: https://pkg01-atx.netgate.com/pfSense_v2_7_0_amd64-pfSense_v2_7_0/packagesite.txz: Permission denied
Unable to update repository pfSense
Error updating repositories!

[stephenw10]

Ok so it looks like it's trying to use v6 by default but there's no route. And something is blocking it when it tries to use v4.

Are you logged in as admin/root?

Do you have outbound block rules? pfBlocker? Snort?

[mrrobot]

@Leonardo-5 in which country you are using ur pfsense router ? i have the same issue as u & we suspect the isp is blocking the traffic !

[Leonardo 5]

@mrrobot Brazil. I'm starting to suspect that the ISP may be the cause of the problem indeed.

[Leonardo 5]

@stephenw10 My ISP doesn't support ipv6. At networking config the parameter "Prefer IPv4 over IPv6" is checked. I am logged as admin when accessing from browser.
I am using PfSense on a virtual machine (I plan to buy a Netgate appliance when possible) and running the command as root gives me the same result.
Outbound NAT mode is automatic, I did not add any rule. I am using pfSense with default settings, then I am not using pfBlocker or Snort.

[stephenw10]

Try running a packet capture on WAN when you are trying to check. Filter by our subnet 208.123.73.0/24.
Make sure you see traffic leavning for the pkg servers at 208.123.73.207 or .209.
If something upstream is blocking that you should see that in a reply since it shows 'permission denied'

[mrrobot]

@Leonardo-5 its gonna be complecated updating or installing packages in this case

[Leonardo 5]

@mrrobot If I find a solution, I will post here and tag you.
@stephenw10 . I will try. Thank you for helping.

[nimrod]

Try this.

Go to System / General Setup

Do not change anything and just click Save.

[mrrobot]

@Leonardo-5 thank you mate, i was gonna try to connect the pfsense appliance as a client at a friend and try to update to see what happens (my friend has a different isp from mine), i ll keep u updated as well ;)

[NETLOGIC]

I am also seeing issues updating the Available Package lists for SG-6100 today.
Was all working perfectly yesterday.

Noticed that I could not check for Firmware also but that was resolved by toggle and save of previous stable release to current stable release.

Now it appears that I cannot see available packages or install any packages.

Here is a dump of command line to try

Shell Output - pkg-static -d4 update

DBG(1)[83227]> pkg initialized
Updating pfSense-core repository catalogue...
DBG(1)[83227]> PkgRepo: verifying update for pfSense-core
DBG(1)[83227]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense-core.sqlite'
DBG(1)[83227]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.conf
DBG(1)[83227]> opening libfetch fetcher
DBG(1)[83227]> Fetch > libfetch: connecting
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.conf with opts "i4"
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.conf with opts "i4"
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.conf with opts "i4"
DBG(1)[83227]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz
DBG(1)[83227]> opening libfetch fetcher
DBG(1)[83227]> Fetch > libfetch: connecting
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz with opts "i4"
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz with opts "i4"
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz with opts "i4"
pkg-static: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz: Bad Request
repository pfSense-core has no meta file, using default settings
DBG(1)[83227]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg
DBG(1)[83227]> opening libfetch fetcher
DBG(1)[83227]> Fetch > libfetch: connecting
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg with opts "i4"
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg with opts "i4"
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg with opts "i4"
pkg-static: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg: Bad Request
DBG(1)[83227]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz
DBG(1)[83227]> opening libfetch fetcher
DBG(1)[83227]> Fetch > libfetch: connecting
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz with opts "i4"
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz with opts "i4"
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz with opts "i4"
pkg-static: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz: Bad Request
Unable to update repository pfSense-core
Updating pfSense repository catalogue...
DBG(1)[83227]> PkgRepo: verifying update for pfSense
DBG(1)[83227]> PkgRepo: need forced update of pfSense
DBG(1)[83227]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense.sqlite'
DBG(1)[83227]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.conf
DBG(1)[83227]> opening libfetch fetcher
DBG(1)[83227]> Fetch > libfetch: connecting
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.conf with opts "i4"
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.conf with opts "i4"
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.conf with opts "i4"
DBG(1)[83227]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz
DBG(1)[83227]> opening libfetch fetcher
DBG(1)[83227]> Fetch > libfetch: connecting
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz with opts "i4"
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz with opts "i4"
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz with opts "i4"
pkg-static: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz: Bad Request
repository pfSense has no meta file, using default settings
DBG(1)[83227]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg
DBG(1)[83227]> opening libfetch fetcher
DBG(1)[83227]> Fetch > libfetch: connecting
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg with opts "i4"
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg with opts "i4"
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg with opts "i4"
pkg-static: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg: Bad Request
DBG(1)[83227]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz
DBG(1)[83227]> opening libfetch fetcher
DBG(1)[83227]> Fetch > libfetch: connecting
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz with opts "i4"
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz with opts "i4"
DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz with opts "i4"
pkg-static: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz: Bad Request
Unable to update repository pfSense
Error updating repositories!

[stephenw10]

@NETLOGIC said in can't update pfsense or install packages:

Bad Request

That Bad Request error means that then client didn't send a currently valid certificate. So either it can't pull a new cert or simply hasn't tried.
Try running pfSense-repoc first.

[NETLOGIC]

@stephenw10 After issuing the following command at the command line:

pfsense-repoc

I saw this:

pfSense-repoc: failed to fetch the repo data
failed to read the repo data.

[stephenw10]

Try: pfSense-upgrade -dc

What errors are shown?

[NETLOGIC]

@stephenw10
Command : /root: pfSense-upgrade -dc

pfSense-repoc-static: failed to fetch the repo data
failed to read the repo data.
failed to update the repository settings!!!
failed to update the repository settings!!!

However when I go to the main status page it shows that it can see and check for current firmware.

23.05.1-RELEASE (amd64)
built on Wed Jun 28 03:57:27 UTC 2023
FreeBSD 14.0-CURRENT

The system is on the latest version.
Version information updated at Wed Aug 9 12:25:29 MDT 2023

[stephenw10]

Ok send me your NDI in chat and I'll check it.

[Leonardo 5]

Well, I don't know what I did, but it worked for about 10 minutes again and that is it, not working anymore.
I noticed that my ISP now supports ipv6, I started to configure ipv6 here, but ipv6 is so weird, I think I will not be able to configure in my setup.
Then I updated the Mikrotik's firmware and packages, which is my router that provides a WAN connection.

Weird, as I was writing this comment something changed, it is working again. Trying to update pfSense.

[Leonardo 5]

Update failed, the problem is back.

[stephenw10]

'Permission Denied' like that really looks like something blocking access and sending that back via icmp. If you're not running pfblocker or Snort it pretty much has to be something upstream.