Unable to retrieve update information (pfSense)

Vargr

I have recently acquired a Netgate SG-3100 with pfSense after my SG-2220 died.

I am a bit of a noob but can manage the most basic stuff (we all have to start somewhere). Please assume that I need to be taken by hand and walked through solutions.

So here is my problem:

When setting up my SG-3100 initially I made some mistakes and lost contact. This forced me to access it through the console and do a “4) Reset to factory defaults” after this everything was dandy – or so I thought.

It works fine as far as routing goes but recently I noticed two things not working:
a) pfSense is unable to check for updates.
b) pfSense’s Package Manager is “unable to retrieve package information”.

When running “pfSense-upgrade -d -c” in the console it finished with “ERROR: Unable to compare version of pfSense-repo”.

So it seems like pfSense is not able to “phone home” or wherever it goes looking for updates.

I have been looking around on the internet and have found some articles that might address my problem (or not) but where the discussion quickly becomes too technical for me. However, I got the impression that something has to be opened in order for the update service to get access to the internet (WAN).

I have looked through https://docs.netgate.com/pfsense/en/latest/troubleshooting/upgrades.html and tried those solutions I understood and assumed was related to my problem (which weren’t many probably due to lack of knowledge on my part).

Technical information:
a) Hardware: Netgate SG-3100
b) pfSense: 2.4.5-RELEASE-p1 (arm) built on Tue Jun 02 17:45:24 EDT 2020 FreeBSD 11.3 STABLE
c) Firewall: Port forward: Nothing (except what I have done myself for games, NAS, VoIP, etc.)
d) Internet connection: Netgate SG3100 is hooked directly into the fiberbox at 1000baseT and the connection works as well as can be expected (no problems here).

I don’t know how to solve this problem so I hope you can help. Thank you in advance.

Gertjan

@vargr

Let's check your DNS :

Open a console - or better : SSH, go for option 8 - and run these 3 :

host -t srv _https._tcp.packages.netgate.com

host files01.netgate.com.

host files00.netgate.com.

What was the answer for each of these ?

Vargr

@gertjan said in Unable to retrieve update information (pfSense):

host files00.netgate.com

Thank you for getting back to me.

[2.4.5-RELEASE][root@pfSense.localdomain]/root: host -t srv _https._tcp.packages.netgate.com
_https._tcp.packages.netgate.com has SRV record 10 10 443 files00.netgate.com.
_https._tcp.packages.netgate.com has SRV record 10 10 443 files01.netgate.com.

[2.4.5-RELEASE][root@pfSense.localdomain]/root: host files01.netgate.com
files01.netgate.com has address 162.208.119.40
files01.netgate.com has IPv6 address 2607:ee80:10::119:40

[2.4.5-RELEASE][root@pfSense.localdomain]/root: host files00.netgate.com
files00.netgate.com has address 162.208.119.41
files00.netgate.com has IPv6 address 2607:ee80:10::119:41

EDIT:
Last time I checked my ISP did not support IPv6 if that should be important.

Gertjan

Ok, good.
No DNS issues.

Side note :
Big warning : even if you can 'see' packages - you should not upgrade or install them right now.
You are only "allowed" t o use packages when you have the latest pfSense version.
And guess what : it's not 2.4.5-p1

Although, I can understand that you kept your 2.4.5-p1, as you might have found what happened when 2.5.0 came out for the arm based devices.

In the console menu, what shows up when you use option 13 ?
if it asks if you want to upgrade, just say "No".

What have you selected here :

?

Vargr

@gertjan

Well, I did not intentionally stay at 2.4.5-p1 although I read about some problems :-)

Enter an option: 13
ERROR: It was not possible to identify which pfSense kernel is installed
Netgate SG-3100 - Serial: 1902210057 - Netgate Device ID: I don't know if the Netgate Device ID is sensitive information?

In the web-interface it is set to "Latest stable version (2.4.x)".

I have two more options in the drop-down menu:
"Previous stable version (2.4.4 - Deprecated)"
"Latest development snapshots (Experimental 2.5.x DEVEL"

I prefer stability over features so I don't think the last option will ever be relevant for me :-)

Gertjan

@vargr said in Unable to retrieve update information (pfSense):

ERROR: It was not possible to identify which pfSense kernel is installed

Can you run :

pkg-static info pfSense-kernel-\* | grep -v -- debug-

I see :
pfSense-kernel-pfSense-2.5.0

and

uname -a

The package update script should find (first test) this info. If not, it bails out with the message :
ERROR: It was not possible to identify which pfSense kernel is installed

Start making backups.
Do some clean-up work. See the Youtube -> Netgate -> "fsck" video.
My advise : contact support and make a clean install. It will takes one minutes nut you'll be sure about the integrity of your device.

Vargr

@gertjan said in Unable to retrieve update information (pfSense):

uname -a

OK, here goes:

[2.4.5-RELEASE][root@pfSense.localdomain]/root: pkg-static info pfSense-kernel-* | grep -v -- debug-

[2.4.5-RELEASE][root@pfSense.localdomain]/root: uname -a
FreeBSD pfSense.localdomain 11.3-STABLE FreeBSD 11.3-STABLE #238 885b1ed26b6(factory-RELENG_2_4_5): Tue Jun 2 17:52:40 EDT 2020 root@buildbot1-nyi.netgate.com:/build/factory-crossbuild-245-armv6/obj/armv6/kJlGauaG/arm.armv6/build/factory-crossbuild-245-armv6/sources/FreeBSD-src/sys/pfSense-SG-3100 arm

The first one returned no output. I ran it twice to be sure. It pauses very briefly and then returns.

So, my next step is to make a backup of the configuration, see if the video helps and then if nothing helps contact support? Or skip straight to the "contact support" step?

Either way, I am extremely thankful for your help and time!

Gertjan

@vargr said in Unable to retrieve update information (pfSense):

The first one returned no output. I ran it twice to be sure. It pauses very briefly and then returns.

and that seems bad to me.

You're using a Netgate device, usining an "arm" version, but still, I thought pcackage would be identical.

Heere is what I see when I run

pkg-static info

........
pfSense-2.5.0                  Meta package to install pfSense required ports
pfSense-Status_Monitoring-1.7.11_3 pfSense Status Monitoring
pfSense-base-2.5.0             pfSense core files
pfSense-default-config-2.5.0   pfSense default config
pfSense-kernel-pfSense-2.5.0   pfSense kernel (pfSense)
pfSense-pkg-Avahi-2.1_1        pfSense package Avahi
pfSense-pkg-Backup-0.5_5       pfSense package Backup
pfSense-pkg-Cron-0.3.7_5       pfSense package Cron
pfSense-pkg-Notes-0.2.9_3      pfSense package Notes
pfSense-pkg-Shellcmd-1.0.5_2   pfSense package Shellcmd
pfSense-pkg-System_Patches-1.2_5 pfSense package System_Patches
pfSense-pkg-acme-0.6.9_3       ACME package for pfSense
pfSense-pkg-freeradius3-0.15.7_30 FreeRADIUS 3.x package for pfSense
pfSense-pkg-nut-2.7.4_8        Network UPS Tools
pfSense-pkg-openvpn-client-export-1.5_6 pfSense package openvpn-client-export
pfSense-pkg-pfBlockerNG-devel-3.0.0_15 pfSense package pfBlockerNG
pfSense-rc-2.5.0               pfSense rc script and rc.initial shell
pfSense-repo-2.5.0_1           Setup pfSense pkg(8) repositories
pfSense-upgrade-0.96           pfSense upgrade script
.....

As you can see, line 5 list de "pfSense kernel version" package.
This test fails on your system.
Maybe you should contact support.
( I would re install after some more in depth research what is missing / happens / happened )

Maybe its just the "installed package list" that is corrupted.

The system reboots fine ? (make a backup first !)

Vargr

@gertjan said in Unable to retrieve update information (pfSense):

pkg-static info

Again, thank you very much for your help!

Well, something seems to be very wrong with my system. Oddly enough it apparently runs fine with regard to the few features I use.

So far the system has rebooted fine (the few times it has been required - normally because there was no electricity). I will make a back-up just in case but luckily I have very little set up.

I will see if I can figure out how the Netgate support system works; I am rather daunted by the subscription model and the price; I hope I somehow misunderstand all that.

Again, thank you very much for your help! It is much appreciated!

Gertjan

Obtaining a new firmware is free of charge.

Vargr

@gertjan

Yes, I just figured that out. :-)

In case someone else stumbles over this thread a new firmware may be obtained as described here: https://docs.netgate.com/pfsense/en/latest/solutions/sg-3100/reinstall-pfsense.html (note, this is for the SG-3100 firmware).

Off to re-install :-)

Vargr

@vargr

Just a quick follow-up and officially closing down this thread:

The problem is solved!

Gertjan was right and a new firmware was required.

It was very easy to obtain and following the link above easy to install (but I always feel nervous when updating firmware).

Remember, that pfsense resets its IP-address to 192.168.1.1 as well as its admin password.

Thank you again to Gertjan!