Unable to update repository pfSense
-
@elvisimprsntr can you resolve other domain names?
-
-
@elvisimprsntr said in Unable to update repository pfSense:
From pfSense GUI or CLI, no.
Using Q9 for upstream DNSHow have you configured DNS, resolver or forward? And your clients use pfSense for DNS lookup?
-
@elvisimprsntr If forwarding, ensure DNSSEC is disabled.
Any restrictions on unbound or is it set to listen on All interfaces?
I would next restart DNS Resolver/unbound, or maybe pfSense.
-
- DNS Resolver
- Yes Clients use pfSense
I tried starting unbound. same issue.
I remotely rebooted my fiber modem (NVG599), and released and renewed WAN interface.Seems to be working again.
Running 2.7.2 with all the latest patches.
This just started happening since I applied the latest swath of patches.
It is behaving like something on pfSense crashed or stops working.
When I disable DNSSEC can't resolve static mappings.
https://forum.netgate.com/topic/196269/att-fiber-dns-issue/13
-
@elvisimprsntr said in Unable to update repository pfSense:
This just started happening since I applied the latest swath of patches.
I know it is obvious but I'd revert patches regarding unbound and see what happens.
-
Are clients, which can resolve, using pfSense for DNS or being passed quad9 to use directly?
What is the DNS behaviour setting in General Setup?
-
@stephenw10 said in Unable to update repository pfSense:
Are clients, which can resolve, using pfSense for DNS or being passed quad9 to use directly?
Client are served pfSense LAN IP address
What is the DNS behaviour setting in General Setup?
-
Hmm, and Diag > DNS Lookup just fails for all configured severs? For any fqdn?
-
Correct.
After rebooting my fiber modem, and releasing and renewing the WAN interface it is working again.
To see if it has any affect, I also deleted the IPv6 Q9 DNS servers.
-
Hmm, weird. Hard to imagine what could have caused that for pfSense but not clients behind it.
-
When I restart both kea-dhcp4 and unbound the problem persists.
When I head to Status -> Interfaces -> Click on WAN Release then Renew, everything starts working again.
Not sure if this error is related when pfSense is trying to get an IP address from my fiber modem, which is in DHCP passthrough mode.
Feb 9 13:45:55 pfSense dhclient[9122]: unknown dhcp option value 0x7dFeb 9 13:45:55 pfSense dhclient[9122]: DHCPREQUEST on igc0 to 192.168.1.254 port 67 Feb 9 13:45:55 pfSense dhclient[9122]: DHCPACK from 192.168.1.254 Feb 9 13:45:55 pfSense dhclient[9122]: unknown dhcp option value 0x7d Feb 9 13:45:55 pfSense dhclient[11337]: RENEW Feb 9 13:45:55 pfSense dhclient[12245]: Creating resolv.conf Feb 9 13:45:55 pfSense dhclient[9122]: bound to [redacted] -- renewal in 300 seconds.The behavior almost seems like it is losing a WAN route.
I piped the following script to a log file while it is working.
Will run again once symptoms reoccur.
#!/bin/sh ifconfig igc0 netstat -rWn cat /var/db/dhclient.leases.igc0What other logs should I comb through for any evidence?
-
@elvisimprsntr said in Unable to update repository pfSense:
Feb 9 13:45:55 pfSense dhclient[9122]: unknown dhcp option value 0x7d
There exists a bug report for FreeBSD regarding this error: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281361
Seems to be about unknown DHCP options send from upstream, more annoying then a real issue.
-
@patient0 said in Unable to update repository pfSense:
Seems to be about unknown DHCP options send from upstream, more annoying then a real issue.
Unless it is somehow affecting KEA
-
@elvisimprsntr said in Unable to update repository pfSense:
Unless it is somehow affecting KEA
Can't see how, two different applications on different interfaces,
dhclientand KEA. But then it's computers and nothing is impossible. -
Yup Kea and Unbound are not dhclient so that's probably unrelated.
Is unbound actually starting correctly?
@elvisimprsntr said in Unable to update repository pfSense:
The behavior almost seems like it is losing a WAN route.
Is it actually losing a route? Is there a default route in the routing table? Can pfSense still ping out by IP address?
