Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    22.05-RELEASE (amd64) Unable to check for updates?

    General pfSense Questions
    6
    61
    12.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      SteveITS Rebel Alliance @TAC57
      last edited by

      @TAC57 said in 22.05-RELEASE (amd64) Unable to check for updates?:

      @stephenw10 Can you tell me where to find the DNAMasq and Unbound options?

      ee84b1b5-1fb4-4e3f-8b9c-30da6fea4d91-image.png

      here:
      DNS Forwarder is not enabled by default. DNS Resolver runs Unbound.

      Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
      When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
      Upvote 👍 helpful posts!

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        DNSMasq is the forwarder so in Services > DNS Forwarder.
        Unbound is the resolver (though it can run in forwarding mode) so in Services > DNS Resolver.

        TAC57T 1 Reply Last reply Reply Quote 0
        • TAC57T
          TAC57 @stephenw10
          last edited by

          @stephenw10 Ok, I made sure the DNS Forwarder is NOT enabled, and made sure the DNS Resolver IS enabled.

          If I clear all my notices, then next time I make a change to my config file I should not see this notice again.
          'An error occurred while uploading the encrypted Netgate pfSense Plus configuration to https://acb.netgate.com/save ( Unable to resolve acb.netgate.com ) @ 2023-06-05 15:20:02'

          TAC57T 1 Reply Last reply Reply Quote 0
          • TAC57T
            TAC57 @TAC57
            last edited by

            @TAC57 Also, if this issues is taken care of shouldn't I be able to put an IP address (8.8.8.8) or a DNS (www.google.com) in pfsenses Diag / DNS Lookup / Hostname field and get a response?

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              If unbound is running in resolving mode then, yes, you should see see answers from 127.0.0.1 when querying a host.

              You can't enter an IP in DNS Lookup though.

              If you still can't resolve anything then something is blocking outgoing DNS.

              You mentioned you have a VPN provider. Did you add any rules to force DNS queries over a VPN?
              Or specific rules to block DNS leaving over the WAN?

              TAC57T 1 Reply Last reply Reply Quote 0
              • TAC57T
                TAC57 @stephenw10
                last edited by

                @stephenw10 In the past (see above) I've enter firmware.netgate.com in DNS Lookup and got a response but get nothing now.

                I have no rules anywhere that have anything to do with port 53 or 853.

                I previously setup a Gateway that sent ONLY my SABnzbd traffic through the VPN and it worked just fine. That has quit working and my VPN provider says it's because 'Per Logs, DNS on pfsense is failing to resolve the hostname.'

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  Hmm, so no configured DNS servers are responding at all when you test there now?
                  Is Unbound actually running in Status > Services?

                  TAC57T 1 Reply Last reply Reply Quote 0
                  • N
                    NOCling
                    last edited by

                    Try dig from Client and pfsense if you capture on WAN with Port 53, do you see DNS querys in the pcap?

                    You found Package Capture in the Diag Menu.

                    Netgate 6100 & Netgate 2100

                    1 Reply Last reply Reply Quote 1
                    • TAC57T
                      TAC57 @stephenw10
                      last edited by

                      @stephenw10 Status > Services, Unbond, DNS Resolver is checked.

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Ok, check the state tables in Diag > States for traffic from the firewall only on port 53 when you try to resolve something in Diag > DNS Lookup.

                        Something must be blocking or at least re-routing that traffic.

                        TAC57T 1 Reply Last reply Reply Quote 0
                        • DefenderLLCD
                          DefenderLLC
                          last edited by

                          You don't have a UniFi device with ad blocking enabled, do you? Because if you do, it redirects all 53/UDP traffic to it's own resolver regardless what you have configured on your client devices.

                          1 Reply Last reply Reply Quote 0
                          • TAC57T
                            TAC57 @stephenw10
                            last edited by

                            @stephenw10 It's weird DNS Lookup will find things and now I just ran it again with 'firmware.netgate.com' and I get 'could not be resolved'.

                            26693511-8a12-40d7-ad2b-8d3601fd95bb-image.png

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Ok, so there you've got a LAN client successfully connecting to 9.9.9.9 creating states on LAN and WAN.
                              And you have an unsuccessful connection via the TG_VPN interface.

                              Is Unbound configured to use TG_VPN as it's outbound interface? And that interface is down?

                              The fact it's connecting to 9.9.9.9 there though means it's not Unbound resolving directly. Is it still set to forwarding mode?

                              All of that looks like you might have followed some instructions from a VPN provider at some point. Is that possible?

                              Steve

                              TAC57T 1 Reply Last reply Reply Quote 0
                              • TAC57T
                                TAC57 @stephenw10
                                last edited by

                                @stephenw10
                                Is Unbound configured to use TG_VPN as it's outbound interface? And that interface is down?
                                f884c09e-1c56-4e70-834f-51445251de20-image.png

                                The fact it's connecting to 9.9.9.9 there though means it's not Unbound resolving directly. Is it still set to forwarding mode?
                                2509576a-6738-4788-ba47-93c59f3804cb-image.png

                                All of that looks like you might have followed some instructions from a VPN provider at some point. Is that possible?
                                Yes, but I've set a rule to force a single source (192.168.30.117) through the TorGuard VPN gateway
                                https://torguard.net/article/254/how-to-setup-the-latest-pfsense-openvpn-client.html

                                H 1 Reply Last reply Reply Quote 0
                                • H haraldinho referenced this topic on
                                • H
                                  haraldinho @TAC57
                                  last edited by

                                  This sounds really a lot like the problem I am having at the moment after I upgrade to 23.05. See my post for more details.

                                  @TAC57 when you ssh into the firewall and run ps -auxwwd, do you also see traces of an upgrade process?

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by stephenw10

                                    If you disable forwarding mode and ssl/tls does it then resolve correctly?

                                    TAC57T 1 Reply Last reply Reply Quote 0
                                    • TAC57T
                                      TAC57 @stephenw10
                                      last edited by

                                      @stephenw10 firmware.netgate.com could not be resolved.

                                      I would be glad to take a phone call on this if you ever do that. DM me if you want.

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Do you at least see states on WAN on port 53 when you try to resolve it?

                                        TAC57T 1 Reply Last reply Reply Quote 0
                                        • TAC57T
                                          TAC57 @stephenw10
                                          last edited by

                                          @stephenw10
                                          Like this?
                                          WAN tcp 96.46.xx.xx:31132 (192.168.30.112:45300) -> 8.8.4.4:53 FIN_WAIT_2:FIN_WAIT_2 4 / 4 277 B / 409 B

                                          stephenw10S 1 Reply Last reply Reply Quote 0
                                          • TAC57T
                                            TAC57
                                            last edited by

                                            I dumped 23.05 from my backup pfSense computer and reloaded 2.6.0 CE and an old config and everything is working perfectly. This backup computer is identical hardware to my primary pfSense unit.

                                            • System reports it's on the latest version (2.6.0-RELEASE)
                                            • DNS Lookup doesn't time out
                                            • Package Manager reports installed packages
                                            • VPN is working and is routing traffic according my my filters
                                            • Jumping between menus / tabs is way faster

                                            If anyone has suggestions fixing the 23.05 issues listed above I'd be glad to jump back to my primary pfSense 23.05 box and try them out.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post