Webgui not accessible. nginx not running

[Gertjan]

@MorrisFury said in Webgui not accessible. nginx not running:

Without the gui this is going to be a challenge. Any ideas?

A VM, right ? Major advantage (imho, the only one) : you have an easy console access.
When you see the menu, go option 8.
Not that much to do there if you don't know anything about the OS used etc, but .... like the PC 'cmd' box : just perfect to look at (and do things with) files.
It's here : /cf/conf/config.xml

Previous backups are here : /cf/conf/backup/

[MorrisFury]

@Gertjan

Yes, I do have access to the console. I have been trying, with my limited knowledge of pfsense to repair it from there but not with much luck. Still figuring out how to get the files off.

I can see the config.xml there.

I can also see the backups.

[Gertjan]

@MorrisFury

You have a VM, so, afaik, you can 'mount' the virtual drive of the VM and access it with a file browser like "Windows Explorer" - the mounted virtual drive will pop up with a new driver letter.
Which means you can access = copy the file easily.

Btw : Dos (Windows), MAC, Linux (and Unix before), FreeBSD and all the others, like your phone and so on : the filesystem is always, for decades now, very similar.

@MorrisFury said in Webgui not accessible. nginx not running:

my limited knowledge

Not really a valid reason
You didn't tell what VM you use. So I can't assist any further.

I presume for now that you use the free, build in Windows "Hyper V" VM hypervisor.
I've used this VM just a couple of time in the past, as it was available with 'a click' just to play with it.
What about this question : I want to retrieve a a file from my virtual drive, and I know I use "Hyper V" (replace with yours if needed) :

How to retrieve a file from the hyper V virtual drive ?

Click and you see the results.
remember, if you have a question, it's exterly rare that you are the very first that asks himself this question.
Millions have had the same question. Thus, and this is a law, Google (maybe other search engines also) knows already about it. So do you now ^^

[johnpoz]

@MorrisFury sp you have part of cert in your /etc/group file? that overwrote most of the file? Yeah something is way wrong..

If you have console access - the .xml are just text files you could copy and paste what is in them into a file that your consoling in from. Vs having to mount the drive, etc.

Did you have ACB set, if so your older configs are in the cloud and can just be loaded from the cloud once you get the replacement pfsense vm setup.

https://docs.netgate.com/pfsense/en/latest/backup/autoconfigbackup.html#restoring-a-configuration

This is the section you would be interested in

https://docs.netgate.com/pfsense/en/latest/backup/autoconfigbackup.html#bare-metal-restoration

But my guess is if you were not doing snaps, you prob don't have the device key and encryption key saved? But you may be able to pull those from the old system.. Have never looked into that because I have those saved off just in case, etc.

edit: Checklist after you're recovered

1: setup ACB saving required info key and password and hint
2: do a manual backup in acb. Prob want to do this at milestones of changes or now and then.
3: save off a manual copy of your config, again do at milestones or on some sort of schedule.
4: Make sure snapshots are taken of your VM on some schedule or manually every now and then update this snap.

[MorrisFury]

Thanks everyone for the help and info. Much appreciated and I have learned a bit more. It looks like I am going to have to do a full rebuild and re-educate myself on the custom configs and how to do them.

The vm is a generation 2 Microsoft hyper-v vm so I cannot copy it somewhere else and map it as a drive to access the config. It wil not allow me due to encryption and figuring out how to get access to it is going to make me old.

The config I had on this pfsense had two internet connections which were configured for auto failover and it took me months to get that working correct. So, learn again and do it again.

I am also facing issues with downloading the iso from Netgate. It is corrupt and I cannot extract it. It is probably due to the poor connectivity I have available in this area. So I am first going to solve that challenge.

I will definitely make sure that checkpoints and acb is configured on the next built. If I find something interesting I will post back here as I am not deleting the old build. I still think it can be fixed somehow.

[Gertjan]

@MorrisFury said in Webgui not accessible. nginx not running:

The vm is a generation 2 Microsoft hyper-v vm so I cannot copy it somewhere else and map it as a drive to access the config.

Look again at this :

https://youtu.be/OCgZAiIVP0k?si=eJdtGdV6iabsiZQc&t=364

@Gertjan said in Webgui not accessible. nginx not running:

How to retrieve a file from the hyper V virtual drive ?

Click and you see the results.

Here :

How to get files off your VM : https://youtu.be/OCgZAiIVP0k?si=llpTfcZpnzx3piNw&t=363

Btw : why doing things more complex then they need to be ?
Save a small small old desktop PC from the wastelands (just check if it has 64 bit CPU) - add a 5 $ NIC and you can forget about all the VM hassle. Go bare bone.

@MorrisFury said in Webgui not accessible. nginx not running:

It is probably due to the poor connectivity I have available in this area

When you download stuff, TCP is used. If a packet comes in bad shape, it will get resend so what you receive will be a binary exact copy of what was send. CRC checksum are used all over the place, and these can't lie.
If bits were falling randomly, you couldn't even connect to this forum using HTTPS and post a message here ^^ A bad connection just becomes a somewhat slower connection, that's it.

If your PC device can't write out the file, any file, an ISO file (then it can't neither maintain a correct vhdx == pfSense VM file system ) .... may by you should landfill it .... wait : transform it into pfSense ?!

[MorrisFury]

I have created a snapshot of the faulty vm and I'm going to do a factory reset now. I am curious to see if that will work and if it is the entire vm that is corrupt.

I suspect I did config acb backups and if I did I will attempt a recovery from there.

[johnpoz]

@MorrisFury do you have or can you find your device key of the current broken vm, because if not - its not going to find it, that key is going to change when you create a new install.

Or do you atleast know the hint - possible netgate can find your backup from that, as long as you know what the password is on the encryption? @stephenw10 would be the guy I would go to for that sort of thing. If he can't do it himself he would know who or the steps required in a tac case, etc.

But if you have access via console or ssh - you can pull those old configs off, or even the current one - as long as they are not corrupted - for the life of me I not coming up with a scenario where the /etc/group file would get a cert or parts of cert file in it - without user intervention causing it.

[MorrisFury]

@johnpoz

So far I have been unsuccessful in getting the old configs off. I also do not know the hint.

I did the factory reset and the webconfigurator fails to start.

interestingly enough when the vm cam back i checked to see if the old backup configs were there for restore. They were all there but a restore did not fix the problem.

This looks like a proper corruption and i think even an acb restore will not fix this.

[MorrisFury]

Some other things I tried:

I tried mounting to a folder on a network nas to copy the conf folder there. I could not as it required a username and password.

I tried using smb but samba is not installed and i was unable to install it as it could not find the package. I tried installing the password but sudo is required and it went absolutely belly up when i tried to install that. It went fully corrupt and I had to revert to a previous checkpoint.

I am not convinced this corruption was caused by a server switching off due to a failed psu. I am starting to wonder if I was hacked somehow. The chances are small as there is a natting router in front of the pfenses which only allowed one port inbound to a different device.

I am downloading the iso over another link and will try a new install.

[MorrisFury]

There is something wrong with the Netgate ISO. I downloaded twice on two different links and using two different laptops and both are giving me the error below:

[johnpoz]

@MorrisFury did you validate the checksum?

the one for VM install should have this I believe - mine matches, I just downloaded it
633CAAD98DD86BA0DDA479CE1051A41B2E5DF64C41E29E82EFD7B1AE4A34B2A4

https://www.netgate.com/hubfs/pfSense-plus-installer-checksums.txt

The name doesn't seem to match up - but the hash does.

Also use a different tool then built in windows extract, I use 7zip

[Gertjan]

@MorrisFury said in Webgui not accessible. nginx not running:

wrong with the Netgate ISO

Read the doc : Prepare a USB Memstick.

There is a tip :

[MorrisFury]

@Gertjan

7zip did the trick. Thank you.