Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Upgrade pfsense CE 2.7.0 to 2.7.1

    Scheduled Pinned Locked Moved Problems Installing or Upgrading pfSense Software
    89 Posts 24 Posters 29.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      Hmm, just accepts most things I try (png, jpeg) but the rules could be more relaxed for admin users.

      If not though you can always link to an image somewhere else.

      Or alternatively show the outbound NAT rules from the /tmp/rules.debug file like:

      # Outbound NAT rules (manual)
      nat on $WAN inet proto { tcp udp } from 192.168.54.0/24 to any -> 172.21.16.22/32 port 1024:65535  # Test
      
      # Outbound NAT rules (automatic)
      
      # Subnets to NAT 
      table <tonatsubnets> { 127.0.0.0/8 ::1/128 192.168.22.0/24 172.25.10.0/24 192.168.251.0/25 }
      nat on $WAN inet from <tonatsubnets> to any port 500 -> 172.21.16.22/32  static-port
      nat on $WAN inet6 from <tonatsubnets> to any port 500 -> (em0)  static-port
      nat on $WAN inet from <tonatsubnets> to any -> 172.21.16.22/32 port 1024:65535 
      nat on $WAN inet6 from <tonatsubnets> to any -> (em0) port 1024:65535 
      
      1 Reply Last reply Reply Quote 0
      • S
        SteveITS Galactic Empire @reberhar
        last edited by

        @reberhar copy/paste may need a certain number of upvotes? Stuff like changing signature does.

        Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
        When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
        Upvote 👍 helpful posts!

        R 1 Reply Last reply Reply Quote 0
        • R
          reberhar @SteveITS
          last edited by

          @SteveITS Link then ... I can understand why you might want to do that.

          I have forum entries on different platforms. I just haven't spent enough time helping these good folks. I remember how confusing it was at first. Yet, pfSense has been worth the struggle. Now I watch the people I supervise struggle, but that's ok. Productive failures are good teachers.

          Thanks for your help.

          1 Reply Last reply Reply Quote 1
          • P
            Patch @reberhar
            last edited by Patch

            @reberhar said in Upgrade pfsense CE 2.7.0 to 2.7.1:

            So what image formats does this interface accept? Cut and paste certainly does not work, and I think I failed at trying to get png from a screenshot to upload.

            I always paste the screen shot into a paint program, clip / redact as required, save as a jpeg, then in the forum click on the picture icon to upload

            R 1 Reply Last reply Reply Quote 1
            • C
              cclarsen @stephenw10
              last edited by stephenw10

              @stephenw10 said in Upgrade pfsense CE 2.7.0 to 2.7.1:

              pfSense-upgrade -d

              Thank you.

              [2.7.0-RELEASE][admin@pfSense.here]/root: pfSense-upgrade -d
              ld-elf.so.1: Shared object "libcrypto.so.30" not found, required by "php"
              ld-elf.so.1: Shared object "libcrypto.so.30" not found, required by "php"
              ld-elf.so.1: Shared object "libcrypto.so.30" not found, required by "php"
              /usr/local/libexec/pfSense-upgrade: /usr/local/sbin/-repo-setup: not found
              Updating repositories metadata...
              Updating pfSense-core repository catalogue...
              Fetching meta.conf: . done
              Fetching packagesite.pkg: . done
              Processing entries: . done
              pfSense-core repository update completed. 4 packages processed.
              Updating pfSense repository catalogue...
              Fetching meta.conf: . done
              Fetching packagesite.pkg: ....... done
              Processing entries:
              Processing entries............. done
              pfSense repository update completed. 549 packages processed.
              All repositories are up to date.
              Upgrading -upgrade...
              pkg-static: illegal option -- u
              Usage: pkg upgrade [-fInFqUy] [-r reponame] [-Cgix] <pkg-name> ...
              
              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                That is much more useful as real txt. I restored it back to that.

                Ok so it looks like that lib error is the source of your problems there. Everything after that is caused by it. Do this.

                Set the update branch back to 2.7.0 in System > Updates > Update Settings.

                Then at the command line run: pkg-static upgrade pkg

                That will force pkg to downgrade back to the 2.7.0 version along with the cryptolib.

                Once there make sure pkg-static -d update works.

                Now try setting the branch back to 2.7.1 and upgrading again.

                Steve

                C 1 Reply Last reply Reply Quote 0
                • C
                  cclarsen @stephenw10
                  last edited by

                  @stephenw10

                  [2.7.0-RELEASE][admin@pfSense.here]/root: pkg-static upgrade pkg
                  No active remote repositories configured.

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by stephenw10

                    You set the branch to 2.7.0 first?

                    Oh you might need to run pfSense-repo-setup

                    C 1 Reply Last reply Reply Quote 0
                    • C
                      cclarsen @stephenw10
                      last edited by

                      @stephenw10 said in Upgrade pfsense CE 2.7.0 to 2.7.1:

                      pfSense-repo-setup

                      I did. Looks like maybe a rebuild is in order?

                      [2.7.0-RELEASE][admin@pfSense.here]/root: pfSense-repo-setup
                      ld-elf.so.1: Shared object "libcrypto.so.30" not found, required by "php"
                      ld-elf.so.1: Shared object "libcrypto.so.30" not found, required by "php"
                      cp: /usr/local/etc/pkg/repos/.conf: No such file or directory
                      /usr/local/sbin/pfSense-repo-setup: /usr/local/sbin/-repoc-static: not found
                      failed to update the repository settings!!!

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Might be easiest/quickest.

                        What does cat /etc/platform show?

                        If that doesn't show pfSense you can try setting it to that.

                        You could also try: pfSense-repoc-static

                        C 1 Reply Last reply Reply Quote 0
                        • C
                          cclarsen @stephenw10
                          last edited by

                          @stephenw10 said in Upgrade pfsense CE 2.7.0 to 2.7.1:

                          pfSense-repoc-static

                          [2.7.0-RELEASE][admin@pfSense.here]/root: cat /etc/platform
                          pfSense
                          [2.7.0-RELEASE][admin@pfSense.here]/root: pfSense-repoc-static
                          ld-elf.so.1: Shared object "libcrypto.so.30" not found, required by "php"
                          pfSense-repoc-static: cannot read pfSense pkg prefix
                          failed to collect the system information.

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Hmm, I'd love to know how it's got into that state but installing 2.7.1 directly and restoring the config is going to be the fastest way back I think. If you're able to do that.

                            C R D 3 Replies Last reply Reply Quote 0
                            • C
                              cclarsen @stephenw10
                              last edited by

                              @stephenw10

                              I will rebuild (already have 2.71 downloaded). I can tell you the steps I took to see if that sheds any light for you. Everything was working well prior to attempting the upgrade. Before I attempted the 2.7.1 upgrade, I updated all the packages that showed they were out of date. That included:

                              nmap
                              openvpn-clinet-export
                              pfBlockerNG
                              snort
                              LightSquid

                              after the upgrades, I attempted the 2.7.1 upgrade and it failed just like you've seen above, but then I started getting a bunch of php failures (specifically having to do with the LightSquid package). It seemed like one of the package upgrades impacted the php install and caused all of the problems we're seeing now. At least that is what it appears like to me. Thank you for your assistance.

                              S 1 Reply Last reply Reply Quote 0
                              • S
                                SteveITS Galactic Empire @cclarsen
                                last edited by

                                @cclarsen said in Upgrade pfsense CE 2.7.0 to 2.7.1:

                                Before I attempted the 2.7.1 upgrade, I updated all the packages that showed they were out of date

                                That will break things, never do that. See my sig. Uninstall packages as suggested per the upgrade guide, or just upgrade and the upgrade will uninstall/reinstall for you.

                                Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                Upvote 👍 helpful posts!

                                1 Reply Last reply Reply Quote 1
                                • R
                                  reberhar @stephenw10
                                  last edited by reberhar

                                  This post is deleted!
                                  1 Reply Last reply Reply Quote 0
                                  • R
                                    reberhar @Patch
                                    last edited by

                                    @Patch Thanks Patch ... I will try that. It has been somewhat frustrating to get some images placed on this site. If necessary I will just past a link.

                                    1 Reply Last reply Reply Quote 0
                                    • S saidin referenced this topic on
                                    • R
                                      reberhar @stephenw10
                                      last edited by

                                      @stephenw10 Hi Stephen,

                                      So my update problem with my secondary servers appears to be DNS. In the unbound DNS resolver, If I include either WAN or localhost in the outgoing DNS window I get resolution on my secondary. I am including localhost. I had already included localhost in the Interfaces window, as per normal in my understanding, unless of course I got them reversed. pfBlockers windows tend to confuse the isse. I always thought that for the firewall to be able to access the Internet I need to put localhost in Network interfaces. Now I am wondering if I got them switched, that is if I need to put localhost in the outgoing window instead. As localhost is not an Internet port I am a little confused as to what is happening.

                                      I have to think about this for a little while, run some tests, reresarch it, and understand it. Understanding is important. Just enabling things because they work is not recommended procedure.

                                      Of course your wise input is always appreciated.

                                      Roy

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        What did you have selected for outgoing interfaces when it was failing?

                                        R 1 Reply Last reply Reply Quote 0
                                        • R
                                          reberhar @stephenw10
                                          last edited by reberhar

                                          @stephenw10 Just the virtual wan ip. I did the same thing for Squid.

                                          I just did the Squid change recently. Squid is supposed to turn itself off anyway, so I don't really know if the vip is necessary there. Maybe not on the DNS resolver either. Of course we want DNS to work on the secondary unit.

                                          I think I just chose those in each of those spots because it seemed appropriate. There is not much posted on using the vip in those packages. I just remember bbcan posting how to setup pfblocker on an early post including suggestions for the DNS resolver. But of course he didn't design pfBlocker for HA although there is a place for a VIP. On some of my equipment I have not been able to use that function. It does not function as expected. On those boxes I had problems with flooding when I tried the VIP on pfblocker. It is a very complex setup though with 4 heads. When I have a chance I will work it out the problems on the 12 to 5 shift.

                                          That being said, I am grateful for bbcan's contribution. pfBlocker is an extremely useful package and I am glad for it and his efforts to maintain it.

                                          Right now I just want to work on the appropriate DNS setting regardless of what any post might say.

                                          Thanks for your suggestions.

                                          stephenw10S 1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator @reberhar
                                            last edited by

                                            @reberhar said in Upgrade pfsense CE 2.7.0 to 2.7.1:

                                            Just the virtual wan ip.

                                            Ah, well that would explain it. The WAN CARP VIP is only ever valid on the master node so a backup node could not use that to send DNS queries.

                                            R 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.