Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    can't update pfsense or install packages

    General pfSense Questions
    9
    148
    27.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      nimrod
      last edited by

      Try this.

      Go to System / General Setup

      Do not change anything and just click Save.

      1 Reply Last reply Reply Quote 0
      • M
        mrrobot @Leonardo 5
        last edited by

        @Leonardo-5 thank you mate, i was gonna try to connect the pfsense appliance as a client at a friend and try to update to see what happens (my friend has a different isp from mine), i ll keep u updated as well ;)

        1 Reply Last reply Reply Quote 1
        • N
          NETLOGIC
          last edited by NETLOGIC

          I am also seeing issues updating the Available Package lists for SG-6100 today.
          Was all working perfectly yesterday.

          Noticed that I could not check for Firmware also but that was resolved by toggle and save of previous stable release to current stable release.

          Now it appears that I cannot see available packages or install any packages.

          Here is a dump of command line to try

          Shell Output - pkg-static -d4 update

          DBG(1)[83227]> pkg initialized
          Updating pfSense-core repository catalogue...
          DBG(1)[83227]> PkgRepo: verifying update for pfSense-core
          DBG(1)[83227]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense-core.sqlite'
          DBG(1)[83227]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.conf
          DBG(1)[83227]> opening libfetch fetcher
          DBG(1)[83227]> Fetch > libfetch: connecting
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.conf with opts "i4"
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.conf with opts "i4"
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.conf with opts "i4"
          DBG(1)[83227]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz
          DBG(1)[83227]> opening libfetch fetcher
          DBG(1)[83227]> Fetch > libfetch: connecting
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz with opts "i4"
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz with opts "i4"
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz with opts "i4"
          pkg-static: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/meta.txz: Bad Request
          repository pfSense-core has no meta file, using default settings
          DBG(1)[83227]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg
          DBG(1)[83227]> opening libfetch fetcher
          DBG(1)[83227]> Fetch > libfetch: connecting
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg with opts "i4"
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg with opts "i4"
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg with opts "i4"
          pkg-static: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.pkg: Bad Request
          DBG(1)[83227]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz
          DBG(1)[83227]> opening libfetch fetcher
          DBG(1)[83227]> Fetch > libfetch: connecting
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz with opts "i4"
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz with opts "i4"
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz with opts "i4"
          pkg-static: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_1_amd64-core/packagesite.txz: Bad Request
          Unable to update repository pfSense-core
          Updating pfSense repository catalogue...
          DBG(1)[83227]> PkgRepo: verifying update for pfSense
          DBG(1)[83227]> PkgRepo: need forced update of pfSense
          DBG(1)[83227]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense.sqlite'
          DBG(1)[83227]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.conf
          DBG(1)[83227]> opening libfetch fetcher
          DBG(1)[83227]> Fetch > libfetch: connecting
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.conf with opts "i4"
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.conf with opts "i4"
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.conf with opts "i4"
          DBG(1)[83227]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz
          DBG(1)[83227]> opening libfetch fetcher
          DBG(1)[83227]> Fetch > libfetch: connecting
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz with opts "i4"
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz with opts "i4"
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz with opts "i4"
          pkg-static: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/meta.txz: Bad Request
          repository pfSense has no meta file, using default settings
          DBG(1)[83227]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg
          DBG(1)[83227]> opening libfetch fetcher
          DBG(1)[83227]> Fetch > libfetch: connecting
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg with opts "i4"
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg with opts "i4"
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg with opts "i4"
          pkg-static: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.pkg: Bad Request
          DBG(1)[83227]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz
          DBG(1)[83227]> opening libfetch fetcher
          DBG(1)[83227]> Fetch > libfetch: connecting
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz with opts "i4"
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz with opts "i4"
          DBG(1)[83227]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz with opts "i4"
          pkg-static: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_05_1_amd64-pfSense_plus_v23_05_1/packagesite.txz: Bad Request
          Unable to update repository pfSense
          Error updating repositories!

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            @NETLOGIC said in can't update pfsense or install packages:

            Bad Request

            That Bad Request error means that then client didn't send a currently valid certificate. So either it can't pull a new cert or simply hasn't tried.
            Try running pfSense-repoc first.

            N 1 Reply Last reply Reply Quote 0
            • N
              NETLOGIC @stephenw10
              last edited by

              @stephenw10 After issuing the following command at the command line:

              pfsense-repoc

              I saw this:

              pfSense-repoc: failed to fetch the repo data
              failed to read the repo data.

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                Try: pfSense-upgrade -dc

                What errors are shown?

                N 1 Reply Last reply Reply Quote 0
                • N
                  NETLOGIC @stephenw10
                  last edited by NETLOGIC

                  @stephenw10
                  Command : /root: pfSense-upgrade -dc

                  pfSense-repoc-static: failed to fetch the repo data
                  failed to read the repo data.
                  failed to update the repository settings!!!
                  failed to update the repository settings!!!

                  However when I go to the main status page it shows that it can see and check for current firmware.

                  23.05.1-RELEASE (amd64)
                  built on Wed Jun 28 03:57:27 UTC 2023
                  FreeBSD 14.0-CURRENT

                  The system is on the latest version.
                  Version information updated at Wed Aug 9 12:25:29 MDT 2023

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Ok send me your NDI in chat and I'll check it.

                    1 Reply Last reply Reply Quote 0
                    • E eduardomozart referenced this topic on
                    • D Darkk referenced this topic on
                    • L
                      Leonardo 5
                      last edited by

                      Well, I don't know what I did, but it worked for about 10 minutes again and that is it, not working anymore.
                      I noticed that my ISP now supports ipv6, I started to configure ipv6 here, but ipv6 is so weird, I think I will not be able to configure in my setup.
                      Then I updated the Mikrotik's firmware and packages, which is my router that provides a WAN connection.

                      Weird, as I was writing this comment something changed, it is working again. Trying to update pfSense.
                      5e348358-585e-4c64-a9da-786b486ad783-image.png
                      0ddc2e40-cc4e-4d63-9ee6-1dda84e9eafc-image.png

                      1 Reply Last reply Reply Quote 0
                      • L
                        Leonardo 5
                        last edited by

                        Update failed, the problem is back.
                        1900bc26-56fe-474d-a5f0-e901986c7626-image.png
                        53870b46-5259-4edc-83e1-ae126ac16af7-image.png

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by stephenw10

                          'Permission Denied' like that really looks like something blocking access and sending that back via icmp. If you're not running pfblocker or Snort it pretty much has to be something upstream.

                          L 1 Reply Last reply Reply Quote 0
                          • L
                            Leonardo 5 @stephenw10
                            last edited by

                            @stephenw10 If on my computer within that network I can access the website and download the files, then does it mean that the connection is blocked within the pfSense environment? Is this logic correct? Or maybe because a different port is being used?
                            For example, I have no problems downloading files from https://pkg00-atx.netgate.com/.

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Unlikely, it's just https. In that case I expect to see it blocked on the firewall itself. Usually that's Snort/Suricata but it could be anything blocking outbound traffic. pfBlocker adds rules that could do it. If you have user rules blocking outbound that could also do it.

                              1 Reply Last reply Reply Quote 0
                              • L
                                Leonardo 5
                                last edited by

                                This image is from a video.
                                3da1ae34-d5ec-44f3-a2ed-b2d647ded859-image.png

                                This is mine.
                                848a7ff9-7d29-4fd3-bbf1-e93867a01a2c-image.png

                                Shouldn't my DNS servers show up here as well? I think there is something wrong with my setup.

                                1 Reply Last reply Reply Quote 0
                                • N
                                  nimrod
                                  last edited by

                                  I dont have any DNS servers on my WAN interface either. But i have no issues.

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    They only show there if the WAN is being passed DNS servers by the upstream connection method. So PPPoE or DHCP usually.

                                    1 Reply Last reply Reply Quote 1
                                    • L
                                      Leonardo 5
                                      last edited by

                                      I did a clean install of version 2.7 (I was using 2.6), before configuring something it was already blocked.

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Hmm, so on a clean install you were still seeing those errors? That really does look like an upstream issue then.

                                        L 1 Reply Last reply Reply Quote 0
                                        • L
                                          Leonardo 5 @stephenw10
                                          last edited by Leonardo 5

                                          @stephenw10 Yes, I'm now seeing how packet capture works.

                                          17:01:11.934116 IP 179.16.0.4.65535 > 208.123.73.212.443: tcp 0
                                          17:01:12.057763 IP 208.123.73.212.443 > 179.16.0.4.65535: tcp 0
                                          17:01:12.057779 IP 179.16.0.4.65535 > 208.123.73.212.443: tcp 0
                                          17:01:12.063808 IP 179.16.0.4.65535 > 208.123.73.212.443: tcp 517
                                          17:01:12.185245 IP 208.123.73.212.443 > 179.16.0.4.65535: tcp 1428
                                          17:01:12.185262 IP 179.16.0.4.65535 > 208.123.73.212.443: tcp 0
                                          17:01:12.185365 IP 208.123.73.212.443 > 179.16.0.4.65535: tcp 1428
                                          17:01:12.185369 IP 179.16.0.4.65535 > 208.123.73.212.443: tcp 0
                                          17:01:12.185463 IP 208.123.73.212.443 > 179.16.0.4.65535: tcp 1240
                                          17:01:12.185466 IP 179.16.0.4.65535 > 208.123.73.212.443: tcp 0
                                          17:01:12.186727 IP 208.123.73.212.443 > 179.16.0.4.65535: tcp 1035
                                          17:01:12.186735 IP 179.16.0.4.65535 > 208.123.73.212.443: tcp 0
                                          17:01:12.187326 IP 179.16.0.4.65535 > 208.123.73.212.443: tcp 80
                                          17:01:12.187400 IP 179.16.0.4.65535 > 208.123.73.212.443: tcp 491
                                          17:01:12.303401 IP 208.123.73.212.443 > 179.16.0.4.65535: tcp 271
                                          17:01:12.303417 IP 179.16.0.4.65535 > 208.123.73.212.443: tcp 0
                                          17:01:12.303420 IP 208.123.73.212.443 > 179.16.0.4.65535: tcp 271
                                          17:01:12.303421 IP 179.16.0.4.65535 > 208.123.73.212.443: tcp 0
                                          17:01:12.306885 IP 208.123.73.212.443 > 179.16.0.4.65535: tcp 238
                                          17:01:12.306896 IP 179.16.0.4.65535 > 208.123.73.212.443: tcp 0
                                          17:01:12.306990 IP 179.16.0.4.65535 > 208.123.73.212.443: tcp 24
                                          17:01:12.307386 IP 179.16.0.4.65535 > 208.123.73.212.443: tcp 0
                                          17:01:12.321463 IP 179.16.0.4.59588 > 208.123.73.80.53: UDP, length 56
                                          17:01:12.321528 IP 179.16.0.4.41858 > 208.123.73.80.53: UDP, length 44
                                          17:01:12.423343 IP 208.123.73.212.443 > 179.16.0.4.65535: tcp 24
                                          17:01:12.423356 IP 179.16.0.4.65535 > 208.123.73.212.443: tcp 0
                                          17:01:12.423359 IP 208.123.73.212.443 > 179.16.0.4.65535: tcp 0
                                          17:01:12.437823 IP 208.123.73.80.53 > 179.16.0.4.59588: UDP, length 138
                                          17:01:12.437847 IP 208.123.73.80.53 > 179.16.0.4.41858: UDP, length 60
                                          17:01:12.437923 IP 179.16.0.4.60631 > 208.123.73.80.53: UDP, length 56
                                          17:01:12.437970 IP 179.16.0.4.64708 > 208.123.73.80.53: UDP, length 44
                                          17:01:12.554299 IP 208.123.73.80.53 > 179.16.0.4.64708: UDP, length 60
                                          17:01:12.554371 IP 208.123.73.80.53 > 179.16.0.4.60631: UDP, length 138

                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            If you set the view level higher or download that and open it in Wireshark does it show the TCP terminations or permission denied errors?

                                            I don't see any icmp traffic there.

                                            L 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.