2.3.3 is live!

cthomas

Successfully upgraded four stand-alone pfSense firewalls, three virtual, one physical, without incident.

Then, I successfully upgraded five pairs of redundant pfSense firewalls, handling production workloads, in the middle of the day, without incident.

The last three upgrades I have performed on our redundant Cisco firewalls were not as smooth. Great work guys, truly great work, thank you.

…v

DiskWizard

No go 2.3.2_1 -> 2.3.3 from GUI, the current version remains, going to try console tomorrow.

RonpfS

@phil.davis:

On my 2.3.3-RC that was on "Stable" (because that is what was done when 2.3.3-DEVELOPMENT became 2.3.3-RC - to avoid ending up on 2.3.4-DEVELOPMENT), I:

switched to development on GUI Update Settings

used console option 13 to make it look for the development package database, and when it asked to upgrade I said N

switched back to stable on GUI update settings

used console option 13 again, and it found the "right" stable stuff, said "y" to upgrade

I am not sure if that sequence should really be needed, but for me it got the system recognize the "new stable" and upgrade to it.

Did the same to get the WebGUI to offer 2.3.3-RELEASE (i386), I updated with the WebGUI, it rebooted, updated and then I got a double fault crash after starting the package.

2017-02-21 16:20:11	System4.Info	172.x.x.254	Feb 21 16:20:13 kernel: Starting syslog...done.
2017-02-21 16:20:11	System4.Info	172.x.x.254	Feb 21 16:20:13 kernel: Starting CRON... done.
2017-02-21 16:20:11	Cron.Info	172.x.x.254	Feb 21 16:20:13 /usr/sbin/cron[57535]: (CRON) DEATH (cron already running, pid: 25377)
2017-02-21 16:20:11	Daemon.Error	172.x.x.254	Feb 21 16:20:13 php-fpm[483]: /rc.start_packages: Restarting/Starting all packages.
2017-02-21 16:20:11	System4.Info	172.x.x.254	Feb 21 16:20:13 kernel: Starting package Backup...done.
2017-02-21 16:20:11	System4.Info	172.x.x.254	Feb 21 16:20:13 kernel: Starting package Cron...done.
2017-02-21 16:20:11	System4.Info	172.x.x.254	Feb 21 16:20:13 kernel: Starting package System Patches...done.
2017-02-21 16:20:11	Daemon.Notice	172.x.x.254	Feb 21 16:20:13 php-fpm[483]: [pfBlockerNG] Starting cron process.
2017-02-21 16:20:15	User.Notice	172.x.x.254	Feb 21 16:20:17 check_reload_status: Syncing firewall
2017-02-21 16:20:15	Daemon.Error	172.x.x.254	Feb 21 16:20:17 php-fpm[483]: /rc.start_packages: Beginning https://portal.pfsense.org configuration backup.
2017-02-21 16:20:28	Daemon.Error	172.x.x.254	Feb 21 16:20:30 php-fpm[483]: /rc.start_packages: End of portal.pfsense.org configuration backup (success).

**** Crash & Reboot ****

2017-02-21 16:22:46	System4.Info	172.x.x.254	Feb 21 16:22:48 kernel: Configuring LAN interface...done.
2017-02-21 16:22:46	System4.Info	172.x.x.254	Feb 21 16:22:48 kernel: Configuring TEST interface...done.
```After rebooting system seems fine.

I had a similar double fault crash last week after switching from Development to Stable in order to get 2.3.3-RC, but I didn't update before the system crashed while saving an alias and applying change.

BIGGRIMTIM

Tried Phil's option and still not working. Last night I was prompted to update via the GUI so I did and it said it completed successfully. My dashboard is still reporting 2.3.2, however when I go to the update page it reports 2.3.3 as my pics from my previous post shows. Should I try to update to the 2.3.4 development build? If I do can I go back to the stable channel?

ats1995

Name xxx.xxx.xxx
System PC Engines APU2
Serial: –------------------------
Version 2.3.3-RELEASE (amd64)
built on Thu Feb 16 06:59:53 CST 2017
FreeBSD 10.3-RELEASE-p16

Obtaining update status
Platform pfSense
CPU Type AMD GX-412TC SOC
4 CPUs: 1 package(s) x 4 core(s)
Uptime 02 Hours 09 Minutes 27 Seconds
Current date/time
Wed Feb 22 1:20:42 CET 2017

Humble home user here. All good so far.

dpa

Update is flawless. But it seems that the new d3.js traffic graph is flawed. It's reporting that I have a Terrabyte traffic!

Guldil

@DiskWizard:

No go 2.3.2_1 -> 2.3.3 from GUI, the current version remains, going to try console tomorrow.

Same here with a NanoBSD, can't upgrade, i did 3 times : upgrade / reboot / switch splice and finally it's worked…

Jon Centel

everything looks fine - but

from the console menu brings

Another instance is already running… Aborting!

is this ok ?

*** Welcome to pfSense 2.3.3-RELEASE (amd64 full-install) on tantefrida ***

Logout (SSH only) 9) pfTop
Assign Interfaces 10) Filter Logs
Set interface(s) IP address 11) Restart webConfigurator
Reset webConfigurator password 12) PHP shell + pfSense tools
Reset to factory defaults 13) Update from console
Reboot system 14) Disable Secure Shell (sshd)
Halt system 15) Restore recent configuration
Ping host 16) Restart PHP-FPM
Shell

Enter an option: 13

Another instance is already running... Aborting!

ajm

Just upgraded from an initial install of 2.3.2_p1 to 2.3.3-RELEASE.

This completed without error, the system came back up and was working almost perfectly after the reboot.

The only issue spotted so far, is that the DHCP server now fails to use the System-defined DNS server addresses, and instead issues the network interface address as the DNS server. I therefore had to hardcode the correct address in each network config.

I'm very pleased that the team were able to release 2.3.3 alongside all the work going on on later versions.

Fingers crossed my boxes will now stay up longer than 3 weeks without falling over…

phil.davis

The only issue spotted so far, is that the DHCP server now fails to use the System-defined DNS server addresses, and instead issues the network interface address as the DNS server. I therefore had to hardcode the correct address in each network config.

Start a new separate thread about this. I am surprised, but it needs looking into if you have some unusual case here. It would be better to discuss/debug in its own thread.

phil.davis

@Jon:

everything looks fine - but

from the console menu brings

Another instance is already running… Aborting!

is this ok ?

*** Welcome to pfSense 2.3.3-RELEASE (amd64 full-install) on tantefrida ***

Logout (SSH only) 9) pfTop

Assign Interfaces 10) Filter Logs

Set interface(s) IP address 11) Restart webConfigurator

Reset webConfigurator password 12) PHP shell + pfSense tools

Reset to factory defaults 13) Update from console

Reboot system 14) Disable Secure Shell (sshd)

Halt system 15) Restore recent configuration

Ping host 16) Restart PHP-FPM

Shell

Enter an option: 13

Another instance is already running... Aborting!

That happens if you started an update check from the webGUI, and maybe when the dashboard is retrieving the update status.
So after some seconds/minute, option 13 should work.

Derelict

@phil.davis:

The only issue spotted so far, is that the DHCP server now fails to use the System-defined DNS server addresses, and instead issues the network interface address as the DNS server. I therefore had to hardcode the correct address in each network config.

Start a new separate thread about this. I am surprised, but it needs looking into if you have some unusual case here. It would be better to discuss/debug in its own thread.

That is and has pretty much always been the default behavior.

DHCP hands out the interface address to clients unless something else is defined there.

The System > General DNS server addresses are used by default by the DNS forwarder / DNS Resolver in forwarding mode to fulfill those requests.

Unless both forwarder and resolver are disabled, in which case the System > General DNS servers are used for DHCP.

ETA: Just ran through a few permutations and could not duplicate.

ajm

@Derelict:

@phil.davis:

The only issue spotted so far, is that the DHCP server now fails to use the System-defined DNS server addresses, and instead issues the network interface address as the DNS server. I therefore had to hardcode the correct address in each network config.

Start a new separate thread about this. I am surprised, but it needs looking into if you have some unusual case here. It would be better to discuss/debug in its own thread.

That is and has pretty much always been the default behavior.

DHCP hands out the interface address to clients unless something else is defined there.

The System > General DNS server addresses are used by default by the DNS forwarder / DNS Resolver in forwarding mode to fulfill those requests.

Unless both forwarder and resolver are disabled, in which case the System > General DNS servers are used for DHCP.

ETA: Just ran through a few permutations and could not duplicate.

Thanks for the quick response.

I just re-read the relevant note on the DHCP server config page; "Leave blank to use the system default DNS servers: this interface's IP if DNS Forwarder or Resolver is enabled, otherwise the servers configured on the System / General Setup page."

I had been running BIND since the initial setup, but for a week or so prior to the 2.3.3 upgrade had switched to Unbound in an attempt to identify the cause of a general 'lock-up' after ~1-3 weeks running. Disabling BIND did not fix this, and I've reverted to BIND after the upgrade.

It seems that enabling then disabling Unbound may have set a flag somewhere that caused what I'm seeing ?

ajm

@ajm:

Thanks for the quick response.

I just re-read the relevant note on the DHCP server config page; "Leave blank to use the system default DNS servers: this interface's IP if DNS Forwarder or Resolver is enabled, otherwise the servers configured on the System / General Setup page."

I had been running BIND since the initial setup, but for a week or so prior to the 2.3.3 upgrade had switched to Unbound in an attempt to identify the cause of a general 'lock-up' after ~1-3 weeks running. Disabling BIND did not fix this, and I've reverted to BIND after the upgrade.

It seems that enabling then disabling Unbound may have set a flag somewhere that caused what I'm seeing ?

Update: panic over, I just backed-out of my workaround and it's behaving fine now. Possibly the sequence of changes I made to disable Unbound and re-enable BIND may have a required a restart of DHCP which I didn't do, so it got its knickers in a twist..

Apologies for the noise. I'm a happy camper for now :)

DiskWizard

Okay, I finally worked out my issue.
Console option 13 - no go as well, then I've tried option 8 (shell)
pkg update -f
pkg upgrade -f
System complain about about gcc has no blah-blah-blah = n
Seems like working fine now.
Best regards.

Keyser Soze

I was skeptical given the numerous upgrade problem threads compounded with my own past experiences of upgrade problems, always having to manually reinstall packages and etc to get things going again.

Performed a CLI (option 13) update to v2.3.3 and much to my astonishment, it just worked.

NOYB

How many of you do a "sane" upgrade process. Like reboot first to make sure everything comes up clean before compounding any issues that may be lurking with a upgrade?

RonpfS

And also disable packages like Snort/Suricata/pfBlockerNG/etc before the reboot .

mifronte

Just completed the upgrade via the web dashboard with success.

BIGGRIMTIM

Had to do a complete clean install. Restored config and things are working again.