pfsense-plus-pkg.netgate.com no DNS resolving

stephenw10 · Apr 10, 2023, 2:42 PM

Yeah it appears to be trying to use v6 and has no v6 routes.

-d4 forces it to use v4 and debug output.

The fact it's just timing out implies it still cannot reach it.

What routes do you have there? You have a default gateway set that is a gateway group with only one gateway in it. Which is odd.
Check Diag > Routes (or netstat -rn at the cli) to be sure you actually have a default route. And that you don't have any rogue routes that might be matching the server address.

bootable · Apr 10, 2023, 3:24 PM

@stephenw10

Using username "admin".
Keyboard-interactive authentication prompts from server:
| Password for admin@fw_pfsense.ycc.lan:
End of keyboard-interactive prompts from server
VMware Virtual Machine - Netgate Device ID: 5c18ec2339d787f345ad

*** Welcome to Netgate pfSense Plus 23.01-RELEASE (amd64) on fw_pfsense ***

 WAN (wan)       -> vmx1       -> v4: 000.000.000.000/24
 LAN (lan)       -> vmx0       -> v4: 000.000.000.000/24
 DMZ (opt1)      -> vmx2       -> v4: 000.000.000.000/24

 0) Logout (SSH only)                  9) pfTop
 1) Assign Interfaces                 10) Filter Logs
 2) Set interface(s) IP address       11) Restart webConfigurator
 3) Reset webConfigurator password    12) PHP shell + Netgate pfSense Plus tools
 4) Reset to factory defaults         13) Update from console
 5) Reboot system                     14) Disable Secure Shell (sshd)
 6) Halt system                       15) Restore recent configuration
 7) Ping host                         16) Restart PHP-FPM
 8) Shell

Enter an option: 8

[23.01-RELEASE][admin@fw_pfsense.ycc.lan]/root: clear
[23.01-RELEASE][admin@fw_pfsense.ycc.lan]/root: pkg -4 -d4 update
DBG(1)[75729]> pkg initialized
Updating pfSense-core repository catalogue...
DBG(1)[75729]> PkgRepo: verifying update for pfSense-core
DBG(1)[75729]> PkgRepo: need forced update of pfSense-core
DBG(1)[75729]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense-core.sqlite'
DBG(1)[75729]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-core/meta.conf
DBG(1)[75729]> opening libfetch fetcher
DBG(1)[75729]> Fetch > libfetch: connecting
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/meta.conf with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/meta.conf with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/meta.conf with opts "i4"
DBG(1)[75729]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-core/meta.txz
DBG(1)[75729]> opening libfetch fetcher
DBG(1)[75729]> Fetch > libfetch: connecting
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/meta.txz with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/meta.txz with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/meta.txz with opts "i4"
pkg: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/meta.txz: Operation timed out
repository pfSense-core has no meta file, using default settings
DBG(1)[75729]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.pkg
DBG(1)[75729]> opening libfetch fetcher
DBG(1)[75729]> Fetch > libfetch: connecting
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.pkg with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.pkg with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.pkg with opts "i4"
pkg: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.pkg: Operation timed out
DBG(1)[75729]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.txz
DBG(1)[75729]> opening libfetch fetcher
DBG(1)[75729]> Fetch > libfetch: connecting
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.txz with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.txz with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.txz with opts "i4"
pkg: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.txz: Operation timed out
Unable to update repository pfSense-core
Updating pfSense repository catalogue...
DBG(1)[75729]> PkgRepo: verifying update for pfSense
DBG(1)[75729]> PkgRepo: need forced update of pfSense
DBG(1)[75729]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense.sqlite'
DBG(1)[75729]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.conf
DBG(1)[75729]> opening libfetch fetcher
DBG(1)[75729]> Fetch > libfetch: connecting
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.conf with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.conf with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.conf with opts "i4"
DBG(1)[75729]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.txz
DBG(1)[75729]> opening libfetch fetcher
DBG(1)[75729]> Fetch > libfetch: connecting
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.txz with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.txz with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.txz with opts "i4"
pkg: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.txz: Operation timed out
repository pfSense has no meta file, using default settings
DBG(1)[75729]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.pkg
DBG(1)[75729]> opening libfetch fetcher
DBG(1)[75729]> Fetch > libfetch: connecting
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.pkg with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.pkg with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.pkg with opts "i4"
pkg: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.pkg: Operation timed out
DBG(1)[75729]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.txz
DBG(1)[75729]> opening libfetch fetcher
DBG(1)[75729]> Fetch > libfetch: connecting
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.txz with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.txz with opts "i4"
DBG(1)[75729]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.txz with opts "i4"
pkg: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.txz: Operation timed out
Unable to update repository pfSense
Error updating repositories!
[23.01-RELEASE][admin@fw_pfsense.ycc.lan]/root:

netstat -rn
Routing tables

Internet:
Destination        Gateway            Flags     Netif Expire
default            000.000.000.000        UGS        vmx1
1.1.1.1            000.000.000.000        UGHS       vmx1
10.10.1.5          link#10            UHS         lo0
10.10.1.6          link#10            UH       ovpns2
10.10.1.8          link#8             UHS         lo0
10.10.1.8/30       link#8             U       tun_wg0
10.10.10.0/24      link#9             U        ovpns1
10.10.10.1         link#9             UHS         lo0
127.0.0.1          link#5             UH          lo0
000.000.000.000/24      link#2             U          vmx1
000.000.000.000        link#2             UHS         lo0
000.000.000.000        link#2             UHS        vmx1
192.168.2.0/24     10.10.1.6          UGS      ovpns2
192.168.3.0/24     10.10.1.6          UGS      ovpns2
192.168.1N.0/24    link#1             U          vmx0
192.168.1X.1       link#1             UHS         lo0
192.168.1X.0/24    link#3             U          vmx2
192.168.1X.1       link#3             UHS         lo0

Internet6:
Destination                       Gateway                       Flags     Netif Expire
::1                               link#5                        UHS         lo0
fe80::%vmx0/64                    link#1                        U          vmx0
fe80::20c:29ff:fef6:61a9%vmx0     link#1                        UHS         lo0
fe80::%vmx1/64                    link#2                        U          vmx1
fe80::20c:29ff:fef6:61b3%vmx1     link#2                        UHS         lo0
fe80::%vmx2/64                    link#3                        U          vmx2
fe80::20c:29ff:fef6:61bd%vmx2     link#3                        UHS         lo0
fe80::%lo0/64                     link#5                        U           lo0
fe80::1%lo0                       link#5                        UHS         lo0
fe80::%ovpns1/64                  link#9                        U        ovpns1
fe80::20c:29ff:fef6:61a9%ovpns1   link#9                        UHS         lo0
fe80::%ovpns2/64                  link#10                       U        ovpns2
fe80::20c:29ff:fef6:61a9%ovpns2   link#10                       UHS         lo0
[23.01-RELEASE][admin@fw_pfsense.ycc.lan]/root:

stephenw10 · Apr 10, 2023, 3:40 PM

What happens if you try to fetch that file directly?:

[23.01-RELEASE][root@6100.stevew.lan]/root: fetch https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.txz
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg01.atx.netgate.com
36630304624640:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_01-main/sources/FreeBSD-src-plus-RELENG_23_01/crypto/openssl/ssl/statem/statem_clnt.c:1921:
fetch: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.txz: Authentication error

You should see an authentication error like that fetching directly.

bootable · Apr 10, 2023, 3:55 PM

@stephenw10

From a browser with https

with out https from a browser

From a cli on firewall

stephenw10 · Apr 10, 2023, 4:04 PM

OK, go to System > Advanced > Networking and set 'Prefer IPv4 over IPv6'.

Then revisit the update page so it pulls a current repo data set.

bootable · Apr 10, 2023, 4:07 PM

Trace route from WebUI

Trace route from CLI

bootable · Apr 10, 2023, 4:09 PM

@stephenw10

stephenw10 · Apr 10, 2023, 4:14 PM

Now go to System > Update > Update Settings and resave the branch there as 23.01 stable.

You are hitting this: https://redmine.pfsense.org/issues/14137

bootable · Apr 10, 2023, 9:35 PM

@stephenw10 Same issue the catalogue does not be updated !!

stephenw10 · Apr 10, 2023, 10:30 PM

Still no router to host so either there is no route somehow or it's resolving to some IP that's incorrect.
Make sure it's actually resolving as expected:

[23.01-RELEASE][root@6100.stevew.lan]/root: host pfsense-plus-pkg00.atx.netgate.com
pfsense-plus-pkg00.atx.netgate.com has address 208.123.73.207
pfsense-plus-pkg00.atx.netgate.com has IPv6 address 2610:160:11:18::207
[23.01-RELEASE][root@6100.stevew.lan]/root: host pfsense-plus-pkg01.atx.netgate.com
pfsense-plus-pkg01.atx.netgate.com has address 208.123.73.209
pfsense-plus-pkg01.atx.netgate.com has IPv6 address 2610:160:11:18::209

Then run it with -d4 to get debug output and test over IPv4.

Steve