To 2.5.0 or not ? that is the question :)
-
@juanpadiaz said in To 2.5.0 or not ? that is the question :):
@bmeeks Not a problem bmeeks, first devices with 2.4.5_p1 on production cant download or install packages from the package manager, i mean devices with any pfsense version upgrade I have many of them, these problem is a pretty big problem because that means that I can not add any functionality o feature to that device
The only solution to have the package manager back on business is to upgrade to 20.02 but, obviously and as @jwj says is not the more inteligent thing to do to just upgrade in a production environment
But I still need to know if you went to SYSTEM > UPDATE SETTINGS and changed the pfSense repository version to "Previous Stable Version (2.4.5 deprecated)". That is very critical! And you must have done that before trying to install or update any packages.
Changing that setting works on Community Edition (CE) pfSense. I assume it works in pfSense+ (the old Factory Edition), but I'm not 100% positive.
-
@bmeeks excellent many thanks, let me try that
-
@juanpadiaz said in To 2.5.0 or not ? that is the question :):
@bmeeks excellent many thanks, let me try that
But if you did not change that setting first, and attempted any package install or upgrade, then it would have corrupted the
pkgutility on your firewall so it will no longer function under 2.4.5. I'm wondering if that is what has happened to you as the screenshot you posted of "Please wait ....." would only happen if thepkgutility got corrupted. Or that is the most likely cause of that error. -
edit- This post was actually meant as a reply to the OP and in general. Not to you Juan..
Please read the "upgrade notes" about half way down on this page before trying to upgrade to 2.5
https://www.netgate.com/blog/pfsense-plus-21-02-release-and-pfsense-ce-2-5-0-release-now-available.html
We have only 14 boxes out there ourselves and only one had issues OpenVPN config related.. With only 14 boxes we still have a test box in a lab setting to run things on first before any major upgrades. Kinda surprises me that people with more units out there than we do choose not to test first.. But I digress.
-
@bmeeks Many thanks, the package manager back to work!
-
This post is deleted! -
@juanpadiaz said in To 2.5.0 or not ? that is the question :):
@bmeeks Many thanks, the package manager back to work!
Great!
-
This post is deleted! -
Success.
Definitely listen to jwj wise words...have backout plans...have backups...have the stuff handy. I do the same with hardware that costs 10s of thousands more...and can't count how many times that wildly expensive edge or core hardware has needed rework.
So I've been vigorously testing things on the development branch for a few months. Obviously just like everybody else, I can't test all configurations and setups, but I've had good success.
A while back there was a small issue with existing zfs setups (2.4.5 on zfs) being updated via usb/image and erring out with trying to load 2.5.x.rc with zfs. This was resolved. Did extra installs from 2.4.5 > 2.5.0 with existing zfs and ufs just fine. Also did a couple online webconfig initiated updates along the way and those were always fine.
For some reason if your temperature/cpu/update widgets aren't working on the main page; they work now when you turn on the state table size display. Not ideal but clearly not a breaking event and has a valid workaround. I believe by default the state table is shown, so 99.99% of people wouldn't even notice this until they got deep into tweaking the page config.
Packages that I use auto installed just fine after being fed the backup config.
Had a small issue on one install where I couldn't log into the web configurator after a fresh install. Super annoying. Console output said good login...but the login page wasn't going through. This was resolved after resetting all the stuff and using https. I think for the dummy setup I was doing I told it to use http instead, and that there was some small issue where the webconfigurator wasn't passing along to the config pages.
There is a package available for installing realtek drivers for those that have been suffering with that hardware. Seems easy enough, and more importantly seems more stable than previous - also haven't dropped gateway, no dpinger issues, and no unbound issues since testing the realtek driver.
pkg install realtek-re-kmod echo 'if_re_load="YES"' >> /boot/loader.conf.local reboot...winning...Test with
dmesg | grep re0Should say something about Realtek ... and leave out the alphabet soup that the previous driver said.. and show a version: 1.96.04 or something. Default driver doesn't state a version line.
To summarize...I've tested and tried to break a lot of things. It is ready.
It isn't perfect...but nothing ever is. If one finds some sort of serious breaking fault or a scenario that you feel has not been conceived of properly and planned for - you are gladly invited to help testing the development releases to make the next one even better. -
@seamonkey said in To 2.5.0 or not ? that is the question :):
None of my static routes are active in my routing table after upgrading. I tried disabling and re-enabling to no avail.
UPDATE: I was able to get my static routes to show up in the routing table by going to Diagnostics:Tables:negate_networks and emptying the table. Unfortunately, I'm still unable to ping anything on the other side of my site-to-site VPN.
-
I have updated to 2.5.0 and relayd is broken.
So if you rely on this wait a little bit with the update.
-
I also noted on searching for the relayd problem that on the cli the file clog is missing. So now comes the fun part. Which command to read the relayd.log which is binary.
-
Postitive post :)
I have 2 units running HA with pfBlockerNG latest Devel version, OpenVPN for remote access and the OpenVPN client export package, 18 IPsec site to site tunnels, several VLANS, and manual outbound NAT for different VLANS going out on different IP addresses. I run the DNS resolver with domain overrides for customers AD access.
The hardware is a PC Engines APU2d4 with 4Gb Ram, AMD GX-412TC CPU
Upgrade was done using the Web GUI interface from latest 2.4.5. I went for the master first so took backup of config, put CARP into Persistent Maintenance Mode, no one shouted so assumed the rest of the house still had internet then went for the upgrade.
All went through with no issues. Ran a few tests and checked that the config all looked good and exited the Maintenance Mode. Again no shouting from the household so all good.
Then went on and upgrade salve again with no issues.
The routers have now been up for 1 day, 13 hours with no issues.Now, I have found one issue but it's only a display issue. On the Dashboard I have the IPsec status Widget
The Active / Inactive are back to front. I currently have 1 inactive tunnel and 17 active.
If thats the only issue then I'm happy :)
-
Positive upgrade.
Starting from 2.4.5p1, 5 VLANs, 5 VPNs site-to-site (2 IPSec and 3 OpenVPN), 1 OpenVPN road-warrior, pfBlockerNG-devel.
Setup new device from scratch with 2.5.0/zfs, imported old (2.4.5p1) full backup. Added by hand Realtek drivers as pointed before. Lastly, migrated road-warrior VPN from OpenVPN to WireGuard (1 tunnel, n peers.
Possible issue if more than 1 tunnel is actively used).System up and running.
-
To anyone having OpenVPN issues, double check your cryptographic parameters in client and server. I had to add ncp-disable to my PIA connections to get them working again. Also, the update broke my site-to-site connection and I discovered that the IPv4 tunnel network on the client side was blank and was somehow previously working with it blank and with a certificate that didn't exist on the server.
-
@thesurf There is no relayd in 2.5 and it's unlikely to ever come back. It's in the release notes:
https://docs.netgate.com/pfsense/en/latest/releases/2-5-0.html#security-errataYou should use HAProxy instead if you need that functionality.
Steve
-
@seamonkey said in To 2.5.0 or not ? that is the question :):
discovered that the IPv4 tunnel network on the client side was blank and was somehow previously working with it blank and with a certificate that didn't exist on the server.
Something like this could be issues for many users problems. Something that was allowing something to work that was in fact a bug or problem.
As another example - not actually related to 2.5.. But is a sim sort of example. I had freerad running and auth phones to my wireless via eap-tls. There was an update to the freerad package that broke my setup. Because I didn't actually have any uses setup, but it was authing anyway just on cert and not actually checking the cn on the cert matching to username.. When the package was updated to fix that, it broke my connection.
So its quite possible some changes in stuff could break specific setups that were working - but really shouldn't have been..
-
There was a whole bunch pointless and abusive arguing in this thread that I have removed.
Please keep it civil.
Everyone here is working to resolve whatever issues there may be in 2.5. Actual reports with data to allow us to replicate are what will achieve that.
Thanks,
Steve -
@johnpoz In other words, the pfSense update doesn't suck. pfSense just got better at letting you know when your configuration sucks.
-
^ yeah that could be the case in some.. Not saying all, but sure some.. This is why details are so important when reporting something doesn't work. When working through my problem - the thread around if you want to look... It took a bit of time to track it down. Viktor was most helpful in finding the issue..
And after finding it - it was a d'oh moment for sure. Was like how and the hell was it working for so long before ;)
