Help!!!

michmoor

pkg upgrade -fy pfSense-upgrade pfSense-base

pfSense-upgrade -dy

Antibiotic

@michmoor

@michmoor said in Help!!!:

pkg upgrade -fy pfSense-upgrade pfSense-base
Number of packages to be reinstalled: 2
[1/2] Reinstalling pfSense-base-2.7.2...
[1/2] Extracting pfSense-base-2.7.2: 100% 3 B 0.0kB/s 00:05
===> Keeping a copy of current version mtree
===> Removing schg flag from base files
===> Extracting new base tarball
===> Removing static obsoleted files
[2/2] Reinstalling pfSense-upgrade-1.2.1...
[2/2] Extracting pfSense-upgrade-1.2.1: 100% 6 B 0.0kB/s 00:01

@michmoor said in Help!!!:

pfSense-upgrade -dy

pfSense-repoc-static: failed to fetch the repo data
failed to read the repo data.
failed to update the repository settings!!!
failed to update the repository settings!!!

Antibiotic

@Antibiotic The problem still exist, please help!

slu

@Antibiotic
Since you don't write how did you run into this situation its better and faster to reinstall 2.7.2 and reimport your backup.

And this topic title is not very useful to get help...

Antibiotic

@slu Just try to update and got this! pfSense running pfBlockerNG , suricata inline mode and crowdsec.

slu

@Antibiotic said in Help!!!:

Just try to update and got this!

From which version?
How did you start the upgrade?
Did you search in the forum?

Antibiotic

@slu ce 2.7.2 version, tryung update from web gui and terminal, the same
Tried pfsense troubleshooting section for update problem , nothing help/

Gertjan

@Antibiotic said in Help!!!:

pfSense running pfBlockerNG , suricata inline mode and crowdsec

I see this one mentioned a lot : On the command line, SSH or console, option 8 :

certctl rehash

Then you can test this : disable them all. Apply the KIS solution, and work you way up untill it 'breaks' again.
Because : when you install a new, clean pfSense with only one (1) changed setting : the admin password (and no previous config import !!), you know that pfSense can update itself, everything works great. This stopped working because the admin (you) added new configurations.
I wouldn't be surprised if a pfBlockerng IP or DNSBL feed 'forbids' you to connect to the Netgate upgrade servers. This has happened.
Or Suricata disallows the 'update request traffic' because it uses a rule that made it look suspect.
Another favorite one is : the admin found a new way the totally f*ck *p the DNS, so pfSense itself can't resolve anymore for itself : update checks, abc uploaded etc become impossible.

This is what I would do :

If that didn't work out, and without the need of re installing :

From the GUII, export your config.
From the console to SSH : reset to default values.
DO NOT import your config.
DO NOT enter change modify don't even look at DNS settings : pfSense works great 'out of the box' already.
If needed, assign interfaces, make LAN work and stop there - do just the bare minimum.

Now, upgrading / updating whatever does work.

Now : import your config back in.
See that the same issue comes back .....
So :
Have a talk with the admin : he introduced a setting that breaks stuff.
Go back again to "all default".

From now on : add a setting back, step by step, and do extensive testing. take your time.

As soon as the issue came back, undo the last setting change, and your good. Done.

Antibiotic

@Gertjan But after config back up and reset to default, do I need to install all packages back before to apply back up config? I mean suricata crowdsec and pfblockeNG. What about openVPN settings, they will restore?

stephenw10

There was a problem with the CE pkg repos yesterday you may have hit initially. That's fixed now.

No, pkgs are re-installed when you restore the config. Crowdsec will not though because that's not a pfSense package.

Antibiotic

@stephenw10 Oh, me suspect that was a problem not on my side. Now too late, did fresh reinstall. Could pfSense team to make announcement on forum next time this happened? to avoid missing of time for searching a cause of problem!

stephenw10

By the time we realised it was a problem it was already fixed. If it had been something that required a longer outage we would have posted something.