Since about 1400 hours I have been unable to get updates in dashboard

troysjanda

Since about 1400 hours I have been unable to get updates in dashboard. I get the unable to chack error see image

alt text

stephenw10

Hmm, I see that. Checking....

troysjanda

@stephenw10 maybe update server down?
I removed all my firewaall rules and port forward and still not able to
set to use exturnal dns only
and still unable to get an update status

stephenw10

It looked like a cert error. There were some changes to the back-end earlier. I was testing it at the time and didn't hit it but could just now. Anyway it looks OK to me now, can you retest?

troysjanda

@stephenw10 I am able to now thanks.

mrsunfire

I am seeing this error too on my 2.6.0. Also package manager is kind of slow/empty. If I refresh the page sometimes I see my packages installed. Trying to update them gives me an empty page/hang.

Doing a

pkg-static clean -ay; pkg-static install -fy pkg pfSense-repo pfSense-upgrade

it hangs on "Updating pfsense-core repository catalogue" or takes up to 5 minutes until it continues with "pfsense repository catalogue".

The whole update via shell took me about 15 minutes!

Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
The following 3 package(s) will be affected (of 0 checked):

Installed packages to be REINSTALLED:
        pfSense-repo-2.6.0 [pfSense]
        pfSense-upgrade-1.0_12 [pfSense]
        pkg-1.17.5_2 [pfSense]

Number of packages to be reinstalled: 3

4 MiB to be downloaded.
[1/3] Fetching pkg-1.17.5_2.pkg: 100%    4 MiB 399.6kB/s    00:10
[2/3] Fetching pfSense-repo-2.6.0.pkg: 100%    6 KiB   5.9kB/s    00:01
[3/3] Fetching pfSense-upgrade-1.0_12.pkg: 100%   15 KiB  15.2kB/s    00:01
Checking integrity... done (0 conflicting)
[1/3] Reinstalling pkg-1.17.5_2...
[1/3] Extracting pkg-1.17.5_2: 100%
[2/3] Reinstalling pfSense-repo-2.6.0...
[2/3] Extracting pfSense-repo-2.6.0: 100%
[3/3] Reinstalling pfSense-upgrade-1.0_12...
[3/3] Extracting pfSense-upgrade-1.0_12: 100%
You may need to manually remove /usr/local/etc/pkg.conf if it is no longer needed.

pkg-static update -f also takes up to 5 minutes:


Updating pfSense-core repository catalogue...
Fetching meta.conf: 100%    163 B   0.2kB/s    00:01
Fetching packagesite.pkg: 100%    2 KiB   1.7kB/s    00:01
Processing entries: 100%
pfSense-core repository update completed. 7 packages processed.
Updating pfSense repository catalogue...
Fetching meta.conf: 100%    163 B   0.2kB/s    00:01
Fetching packagesite.pkg: 100%  149 KiB 153.0kB/s    00:01    ite.pkg:   0%
Processing entries: 100%
pfSense repository update completed. 511 packages processed.
All repositories are up to date.

decibel

mrsunfire

@decibel The issue was that IPv6 was used. Under System/Advanced/Networking make sure to check "Prefer IPv4". This fixed the issue for me.

sigi

Did i miss something? The name resolution seems to be gone..

cat /usr/local/share/pfSense/pkg/repos/pfSense-repo.conf
FreeBSD: { enabled: no }

pfSense-core: {
  url: "pkg+https://packages.netgate.com/pfSense_v2_6_0_amd64-core",
 ....
}

pfSense: {
  url: "pkg+https://packages.netgate.com/pfSense_v2_6_0_amd64-pfSense_v2_6_0",
  .....

Seems not even to be known by netgates DNS...?

dig @ns1.netgate.com packages.netgate.com

; <<>> DiG 9.16.26 <<>> @ns1.netgate.com packages.netgate.com
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60585
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: ba07c4e5a9653cc584e5d713623f21617a7afde345e5e818 (good)
;; QUESTION SECTION:
;packages.netgate.com.          IN      A

;; AUTHORITY SECTION:
netgate.com.            60      IN      SOA     ns1.netgate.com. admin.netgate.com. 2020641778 28800 7200 1209600 60

;; Query time: 136 msec
;; SERVER: 208.123.73.80#53(208.123.73.80)
;; WHEN: Sat Mar 26 15:21:21 CET 2022
;; MSG SIZE  rcvd: 123

SteveITS

@sigi said in Since about 1400 hours I have been unable to get updates in dashboard:

miss something

Yeah :)
https://docs.netgate.com/pfsense/en/latest/troubleshooting/upgrades.html#packages-netgate-com-has-no-a-aaaa-record

sigi

Ouch.. Very intuitive for debugging. Agree this is not the issue. Anyway at the moment i have again this update issues with two boxes from different AS. Both with good working and monitored IPv6. Obviously i am not alone with this issue, maybe worth debugging on Netgate side anyway...

Traveller

@sigi Never had an issue before, but the suggestion to Prefer IPv4 under System->Advanced->Networking seems to have solved the problem for me.

Now, I don't know if the issue was at Netgate or with my ISP.

stephenw10

There is some on going work to our backend infrastructure and this appears to be related. It's a problem with IPv6 connectivity. I see it too on systems that have v6, we are working to resolve it.

It's not the same issue that caused the cert error originally seen in this thread.

Steve

stephenw10

That has been resolved. Please retest. Let us know if you see any issues fetching packages.

Steve

Traveller

@stephenw10 Reverted the Prefer IPv4 setting to Unchecked.

Updates are still working.

Thondwe

@stephenw10 Removed IP4 preference and confirmed working. Also did a tracert pkg01-atx.netgate.com - 20 hops on IPv6 vs 13 for IPv4 - thought IPv6 routing was supposed be slicker!

Tracing route to pkg01-atx.netgate.com [2610:160:11:18::209]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 2001:4d48:ad5c:fe10::254
2 9 ms 8 ms 8 ms 2001:4d48:feed:97::138
3 10 ms 10 ms * 2001:4d48:feed:97::1
4 9 ms * 10 ms 2001:4d48:feed:99::a
5 15 ms 15 ms 15 ms 2001:4d48:ace::43
6 15 ms 15 ms 15 ms ams-ix-1.enta.net [2001:7f8:1::a500:8468:1]
7 15 ms 19 ms 22 ms er1.ams1.nl.above.net [2001:7f8:1::a500:6461:1]
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 126 ms * 126 ms ae5.cs1.lhr11.uk.eth.zayo.com [2001:438:ffff::407d:1d7e]
12 * * * Request timed out.
13 * * * Request timed out.
14 134 ms 130 ms * 2001:438:ffff::407d:1c9e
15 126 ms 126 ms 126 ms ae8.mpr1.aus1.us.zip.zayo.com [2001:438:ffff::407d:1b1e]
16 123 ms 123 ms 123 ms 2001:438:ffff::407d:20c6
17 124 ms 124 ms 124 ms 2610:160::ffff:4014:e59e
18 123 ms 123 ms 123 ms 2610:160:11:1::6
19 124 ms 123 ms 123 ms 2610:160:11:1000::6
20 124 ms 123 ms 123 ms 2610:160:11:18::209