Download location for 2.4.5-RELEASE-p1 (amd64)

renesdk

@mrsunfire said in Download location for 2.4.5-RELEASE-p1 (amd64):

How do I downgrade to 2.4.5 from 2.5.0?

No idea as I haven't had the need to.
I would think you reinstall and use the backed up config from the old version that you take before the upgrade to set it up again with 2.4.5 p1

mrsunfire

@renesdk So I can't do it remote.

renesdk

@mrsunfire said in Download location for 2.4.5-RELEASE-p1 (amd64):

@renesdk So I can't do it remote.

Exactly. You will need physical access to reinstall.

nfld_republic

@mrsunfire Unless you have out-of-band IPMI (this might be difficult if your pfSense box is your edge devices), you need to have physical access to the box.

N8LBV

Removing any access to 2.4.5 is very much a huge dick move.
I upgraded one box to 2.5 and lost all of my VPN functionality..
I had a few site to site IPSEC VPNS to other 2.4.5 locations that worked perfectly
And I had OpenVPN server setup that worked great with mobile clients.
Upgrading to 2.5 broke both systems.
I have not had time to figure out but I already tried all of the simple things.
And have finally considered going back to 2.4.5 for now because it works.
And see that the download is pulled away.

bennyc

@n8lbv
for IPSec there are 6 system patches which address some -in meantime- known issues. You can pick up the id's in various threads in the IPSec section, e.g.:
https://forum.netgate.com/topic/161291/sg-5100-21-02-ipsec-tunnels-duplicate-incorrect-status

OpenVPN: doublecheck crypto setting, and triple-check the compression settings on your 2.5.0 server side to allow backward compatibility. (I've done 5 upgrades, all have some variant of OpenVPN implementation, all work(ed eventuately ))

If you really want to go back, open a ticket at Netgate (they are nice) or take a look here:
https://forum.netgate.com/topic/161085/download-location-for-2-4-5-release-p1-amd64

Reflecting on my own answer here, a grouped/official page from Netgate with known issues & solutions would be better than everyone running into issues and searching (frustrated clicking) in the forum. My 2 cents...

N8LBV

@bennyc Thanks for the info!!
I have already posted about openvpn specifically asking if there were known issues and the feedback I get there is that there are none or that I can't be helped becasse I have not posted my logs publicly in the thread.
The typical you can't just post "It's broke" and expect us to work on it.
While I was first probing for general answers if there are problems out of the box or is it me.

I'd prefer to move forward with 2.5 if I can.
But so far it appears that both IPSEC and openVPN don't function at all (for me) out of the box.
I even tried a simple IPSEC site to site VPN like I have setup a million times before and it is not working at all.

And I'm not making heads or tails yet at all from the logs on my own on what is going on.
No obvious errors to me but the VPN is not coming up.

I've never had these kinds of problems bringing up VPN functionality on PFSense in the past
And I've never yet had to ask for help. It just worked.
And I have enough experience to figure things out on my own most of the time.

N8LBV

Six Patches for IPSEC.
And this is called a "Release"?

Was any of it tested by anyone before "releasing" it? and removing 2.4.5 from being able to get it?

bennyc

@n8lbv
You will get there. On my first upgrade, I had to convert to IPSec as well because one 2.5 -> 2.5 openvpn instance crapped out on me. Still don't know why, because on that site I don't have that much logging and it wasn't an obvious reason, and nothing seen in log that I could feed to the community.
So IPsec was the way to go, and 2.5 -> 2.5 it kind of worked out of the box.
I'm working my way back to full openVPN as I need that in a setup between 2 datacenters with Netgate applicances, a double HA with one multiwan, and I do not want to have a downtime longer than needed when I upgrade those. So I'm testing some scenarios (2.4.5 and 2.5.0, mixed, directions, ...) and can confirm that IPSec and OpenVPN work, at least for me and in my setup. YMMV
Anyways, back to your issue. I am pretty sure you can get the IPSec working without much work. Are both sides in your control? If yes: Work on your Phase 1 first, then Phase 2. Keep it simple at first (unless you are protecting fort knox), and don't forget to allow traffic in the Rules. Remember to kill sessions if you made changes (both sides, in status\ipsec -> disconnect) because it keeps it going with earlier done config! (don't ask how I know, and yes my head still hurts a bit)
If things are not working, create a new topic in IPSec. It will draw more attention from the right people there...
(and the same goes for OpenVPN stuff)

bennyc

@n8lbv
Don't shoot the messenger?

Yes, 6 patches, bugs do happen, to err is human.
You may not like it, but Patches are an easy solution, better than waiting for a next release, and faster than doing a fresh install IMHO. (don't need to drive onsite + you get to keep the updated BSD. How's that for a win-win )