Lack of foresight killed the system
New here, and I chose an appropriate username.
A whole comedy of errors has made me basically want to shoot myself in the head with how much everything isn't working.
We didn't update our Pfsense for a long time due to the higher ups insisting that they must use PPTP. They just pay me, OK? I can tell them a lot of stuff but that doesn't mean they will listen.
I finally got the OK to upgrade the other day so I just used the GUI update. It stops at 2.3.5 and it won't even take itself up to 2.4.4.
Yes, I realize it was a major dumb move to go from a 2.2 to a 2.4. I didn't realize that NanoBSD was no longer being supported or that going straight from 2.2 to the final 2.4 release would basically cause a huge issue. It's to the point where I can't download packages (which I need for client export and ciphers) and most of the updates that are needed for stable function aren't installing successfully.
Now that I've learned, I do have a backup from a few years ago (luckily we haven't changed a thing since then). Even if that weren't the case, I'm more than happy to start over from scratch to create the VPN and Firewall rules I need to get things done. I don't need help with that.
I need help unscrewing this mess.
How do I completely get this redone and updated to the newest version? Links and in-depth instructions would be very helpful (I don't use this device much and networking isn't my strongest category).
Which version of the software do I download if I have to do it manually? I don't understand what everyone means when they talk about the Hash of the downloads.
Any and all help would be very appreciated.
KOM last edited by
That depends. What type of unit is this? A pc? Alix board? As long as you have a valid config.xml backup, you should be able to download and install a fresh image and then restore your config.
Download the latest version, 2.5.1. There is no other version available. A file hash is just a method of ensuring that the image you download is genuine and unmodified.
It's an actual network device that's purely just a firewall and VPN appliance. I don't remember the brand and name but it's just a small square shaped metal box that lives among the server and network devices.
How does one go about this? Do I flatten the device first and take it back to factory? Or is there some way to manually load up the latest version and force the system to install ALL of the components so I can use the missing features?
I think I miss phrased that question. I wouldn't mind downloading and updating the last version. But I got really confused with how many people online were complaining about SHA vs MD5 hashed versions of the software and some incompatibilities with the installations after download.
Gertjan last edited by Gertjan
But I got really confused with how many people online were complaining about SHA vs MD5 hashed versions of the software and some incompatibilities with the installations after download.
People are actually using (testing) these MD5 hashes or SHA256 values from https://www.pfsense.org/download/ ?
purely just a firewall and VPN applianc
Then there are no pckages to download (edit : exception the OpenVPN client package). Just install the new 'firmware' = pfSense 2.5.1 by downloading it, burning it to a USB drive and boot from the USB drive.
Btw : everything and more is in the Manual.
Btw : also in the manual : when you're using an old version, you can't (should NOT ! - see every Blog page of every pfSense version !) update / upgrade / install packages. That can 'break' your older pfSense version.
Added to that : using an old version does imply accepting security issues that are 'out there in de wild == known to everybody'. You could have just just that explanation justify an upgrade from 2.3.5.
If pfSense was a coffee machine, or IOT doorbell or your aquarium light timer device, you could consider not upgrading.
pfSense is a firewall : upgrade .... as only experts could consider using old versions. And guess what : they don't, as live is just to short already.
Also : I advise you to take a backup of your current config.xml and only use it as a reference for the new setup. The file is very readable by humans.
If you use the VPN server, you could use the pfSense "OpenVPN client Export package".
Before you upgrade, burn another USB key with a 'memtest86' and do a system test.
Make another key to test your drive.
Just to be sure the hardware is ok.
Be aware of the issues regarding Multi WAN and VPN on 2.5.1.
2.5.0 or 2.4.5p1 is the latest stable.
If you want to run easy with no issues then I would suggest 2.4.5p1
EveningStarNM last edited by EveningStarNM
@MajorDumPerch I love it the first time a new guy scares themselves by destroying a network. They're so surprised. I'm grateful that I haven't shorted out the planet yet.
Don't Panic. Just don't.
Most of the work in getting pfSense set up right is accomplished by mapping your network, keeping in mind that you can create aliases in pfSense for everything, big and small, unique or grouped. Aliases are your friend.
On paper and in spreadsheets: Map your IP and DNS spaces: WANs (you have at least two ISPs, right?), LAN, perimeter, and no-mans-land networks and their subnets. Map DHCP assignments. Record the MAC IDs of every device on the network. Assign IP addresses by DHCP to every device you can (except servers, routers,... you know.)
Inventory applications that require internet access. What hosts, protocols and Privileged or Registered Ports ports to they require access to?
Finally, inventory any other internet services that are required. Knowing what traffic is required helps to identify what traffic is unnecessary. If there are servers you need to protect, they'll require restrictive Allow rules.
Forget the VPN. You'll do that last. The big babies with the executive suites can come into the office instead of phoning it in. Make sure they understand that it's a low priority with you. You're in charge of the project, and you want to do it right.
But if you thoroughly understand your network, configuring it in pfSense is easier.
After that, there's a how-to for everything. I get my best results from Google and DuckDuckGo. As long as I use search language from the pfSense manual, I'll find what I need.
Install pfSense on a powerful computer. Don't skimp on hardware. If it's got 8 or more cores, be aware that you must double some Flow and Stream memory caps for each interface in Suricata. Search for others' experiences setting up pfSense on your hardware.
Configure Advanced Settings. Change the ports used to access pfSense. I use 47 for https and 227 for ssh. Disable offloads to the NICs. I wish it worked, but offloading sometimes causes problems. Just make sure you have more CPU than you think you need.
Configure DNS and DHCP.
If you're setting up pfSense in an Active Directory environment, quadruple the amount of time you hope the project will take. Then double that. Stretch it out as long as you can and go slowly. S-l-o-w-l-y. Double-check everything before making any changes in AD. Your DCs should use pfSense as their only forwarder, and Unbound should be configured with domain overrides to the DCs for both DNS and RDNS.
Configure your firewall rules, organized in groups of machines, subnets, and networks, similar to how aliases are grouped. Make sure everything can get access to updates and that protected machines have only the access they need. This is where aliases are especially useful.
Don't even dream of configuring authentication yet. You'll do that after you have a week of relaxation, just before you set up the VPN.
Set up pfBlockerNG and Suricata. Don't block too much. Watch the logs. And for that, make sure you're set up the GUI's Dashboard with 3 well-organized columns. I like the Dark-beta theme.
Then take an extra day off. You'll get a list of problems that you can tackle one by one. When they're solved, take a few more days off.
Then you can do certificates (CA, servers, users), network authentication (LDAP or, preferably, RADIUS), and VPN.
Then ask for a raise.
Well, those are the steps that I recommend, anyway. I hope this helps.
EveningStarNM last edited by
We have two WAN connections from two different companies coming into the building from different directions. I followed the instructions in the manual and everything worked fine, including the rollover tests. I've seen where some folks had problems, but I haven't seen any.
Ok, so things got better then worse.
After a few reboots and restores, the system was almost at 100%.
I loaded up a restore to see if it would work. Surprisingly, it did. Packages appeared installed, internet access ok, and all I had to do was some basic troubleshooting.
Then I suddenly lost connection to the GUI and everything on the lan couldn't communicate with anything.
Did a full on reset. Restored a configuration I just saved when things were working well.
System on 2.3.5.
It now wants to download and install packages. But the wan isn't working.
I tried to follow the instruction on the wan connectivity troubleshooting document.
A strange thing I found was the WAN was offline. It only goes online when I make the default gateway and the IP address the same. I know that can't be right because not only are we still not reaching the internet, but the values aren't supposed to be the same.. But if I change them to their correct values, the gateway goes offline. We have a static IP so this shouldn't be like this.
Edit: found in the logs that the gateway is giving a sendto error 64
Anyone have a solution?
if I change them to their correct values, the gateway goes offline
Sounds like the gateway monitoring is triggering and taking it offline? Set the monitoring IP to something else like 188.8.131.52, or check Disable Gateway Monitoring for that gateway.
Did you read the docs on upgrading from old versions?
As I recall 2.4 removed support for 32 bit so if you're stuck on 2.3 check to see if the current install is 32 or 64 bit.
I'm going to try and remember things as I'm posting via my phone and can't see the response.
Did what you put up there.
Still getting send to error 64, no internet.
I keep getting messages about the DNS not resolving but I have DNS forward (all interfaces) on and two DNS addresses already set.
I'm getting a lot of ipv6 entries on the firewall but I didn't set up ipv6 on this device.
The version says 2.3.5 - amd64
I have the update setting on last stable release.
The packages have now disappeared and I'm about broken on how to get this system even back to just getting on the internet. More or less getting the vpns back up and running
And needless to say, the system won't find the update if it can't access the internet.
So I'll remember what you put there for that but getting this system online takes precedence
the system won't find the update if it can't access the internet.
System is not going to find update no matter what if he is running 2.3.5 - those packages are no longer available.. 2.3.5 has been EOL for years.. The whole 2.3.x line went end of life October 31, 2018 - with like 2 years warning of said fact before that.
I'm with @Gertjan on this - this is not your Coffee machine.. Your firewall needs to be kept current.. I get it, I do.. His mention of PPTP.. That has been DEAD!! I mean DEAD - like not secure for what a decade now? I myself have some boxes out of date - but the only reason has been covid.. There is nobody there to allow for an update - I don't care if its a 10K cisco box, or a diy 100$ box, etc. Remotely updating something with no possible way of someone to be on site in the worse case scenario is not a good idea.. So I would never recommend anyone do a remote upgrade, or even local without the proper safety measures in place - as clearly called out in the docs, etc.
Get the current media 2.5.1 and do a clean install is your best solution here. Unless how ever old this box your running on is that old.. Then get a new box!! While there have been people saying 2.5 has issues.. I have had ZERO!! Other than I couldn't do a clean zfs install on the first 21.02 release.. Every package worked, zero issues with unbound.. no problems at all.. Not saying there are not some issues - but with how many users use pfsense, and how many crazy setups are out there.. Yeah there is going to be issues - and who posts.. Users that have issues! If everyone posted that had zero problems with their upgrades - nobody would ever notice the issues ;)
People forget pfsense/netgate is not freaking MS - yet even companies like MS have major problems with their "upgrades" ;) for basic stuff like a printing causing BSOD..
Suggesting someone not go 2.5 for a clean install doesn't make a lot of sense to me - unless that user has called out something specific that has been identified.. Like nating with multiple wan connections, etc.
My advice to @MajorDumPerch would be to take this time to get a new box!! Since I have to assume your box your running on - that you don't even know what it is exactly is quite dated.. Your best bet would be to get a netgate box that works for your connection requirements.
Right now, I'm going to wait for a few days while I get a USB to console cable from Amazon. Found the old console cable that came with the box. Now just needs the connector to my laptop. After that, it's clean install time after watching enough youtube videos and reading blogs.
I'll update after I try it but it won't be until Friday when I actually get the cable from the Amazon Overlords.
I hope this works and that I don't have to get another box. The office is already bearing down on me and it makes me want to play solo Russian Roulette with a loaded Bazooka. I think it should work (barring a complete no go of it) because the processor is a 64-bit one.
I'll talk with the upper management to see if I can get an updated box after this is all over so I can at least futz with it outside of the active work environment.
Until then... wish me luck.
Good luck and yeah console is a must..
Maybe the box is only a few years old.. That would be some good news for sure.. But a new box never a bad idea - possible you can use the situation to your advantage. Old box works with clean install. And you get a new box, and can use that old one as emergency spare on the shelf setup..
And always nice to be able to play with something offline without interrupting production.
Let us know how it turns out..
Maybe you can talk the higher ups into springing for some pfsense training ;) or atleast support contract..
dotdash last edited by
While there have been people saying 2.5 has issues.. I have had ZERO!!
Um, port forwards not working on anything but the default WAN is a major issue for most of my installs. (I'm on CE, I guess they fixed it on Plus)
I agree otherwise, OP should get an Netgate box or an APU (sounds like the old box was an Alix running nano) and restore onto a current version.
Actually it is a Netgate APU box. Just an older one with a console port.
I think we got it around... 2015.
Just a quick update for anyone stuck in this situation.
In order to make double sure that we get this right, my company approved of contracting an PFsense specialist for this situation. The only one in our city.
They had an opening for today and I met them there this morning.
First, the complete flash worked and brought us up to 2.5.1. It took a DB9 to USB cable, a few cursewords, and some unplugging and replugging but eventually the new CE version settled into the system.
However, it didn't solve a lot of problems other than having the system up and running. We still couldn't access the WAN.
A few phonecalls later and we found out that our ISP changed our static IP. When I asked when that happened, they said since late 2015. Both of us were left a bit speechless about it. How has this thing been on the wrong IP address for 6 years now while still working as if nothing happened?
Getting the right static, we then changed all the rules and gateways to match. And now the thing chugs even faster than it used to. There was some bloat from the initial setup that was removed and a few new security measures were put into place.
After asking the guy, he recommended not upgrading the box because this one works just fine and that the next Netgate we'd need would be about $1500 more than this one. I don't think the higher ups would have approved of that.
Before he left, he told me "We make our money doing these emergency network repairs. Next time, sign a service contract and I'll come down during your next update and make sure it goes without a hitch." I'm not going to argue that point and I have his number on speed dial for that occasion.
Thanks for everyone's help.
@majordumperch Now you're done and cool with the guy you've found, but I have been where you are, and the best thing you can do while figuring things out is getting ANY PC out there, slam another NIC, put a pfSense image or whatever you are willing to put, and configure it from scratch to allow the basic things to run, then you take your time dealing with the cable you need and everything else the way @EveningStarNM recommended you.
That way you don't have a lot of people around you waiting and poking you while you are sweating it and trying to learn.
Obviously that's also a bit tricky because your net may not be safe in the meantime.
Gertjan last edited by
getting ANY PC out there, slam another NIC
Make that a dual-or-more NIC card.
Most of use have Window Pro so Hyper-V is one click away : create a VM that runs pfSense. It will run in parallel with the host, making LAN's etc. perfect for trying out settings and other situations.
Except for de card, no extra hardware needed.
@gertjan Yes, I have not mentioned virtualization but that is the idea, VirtualBox runs ok with pfSense, just beware and use the NICs as Bridged and ensure they are not putting any traffic in the Host (no IP, etc)
You can VBox as a service (with Linux) or AlwaysUp in Windows with a watchdog can keep the VM running if it crashes, there are many options. Immutable/Non-Persistent disks helps too.