pfSense 2.8 Installation Fails, and 2.7.2 Cannot Fetch pkg Packages – Repository Unreachable”

rootCRO

Hi,
I’m trying to install pfSense 2.8 (Community Edition), but during installation I get the error:

Cannot reach Netgate servers. Please verify your network settings.

I’ve tested the network connection—internet and DNS both work fine.
However, the installer cannot contact pkg.pfsense.org or services.netgate.com.

When I switched to pfSense 2.7.2, it installs but:

pkg update

fails because the repository URL is unreachable.

Is there an official mirror or working repository for pfSense CE right now?

Gertjan

@rootCRO said in pfSense 2.8 Installation Fails, and 2.7.2 Cannot Fetch pkg Packages – Repository Unreachable”:

Is there an official mirror or working repository for pfSense CE right now?

If there wasn't, a couple of hundred thousand pfSense CE would fail right now ...

@rootCRO said in pfSense 2.8 Installation Fails, and 2.7.2 Cannot Fetch pkg Packages – Repository Unreachable”:

When I switched to pfSense 2.7.2, it installs but:

pkg update

fails because the repository URL is unreachable.

From here, can see what's wrong, but my first though is : is your WAN operational ?
There are many 'Repository Unreachable' messages on the forum, with advise how to handle the situation.

rootCRO

Thanks for your reply.

The issue is that when I install pfSense using the offline image (version 2.7.2), I can successfully ping google.com and 8.8.8.8, so WAN connectivity is fine.

However, I cannot reach (ping) package servers like
services.netgate.com or http://pkg.freebsd.org/FreeBSD:14:amd64/latest/.

When I try to install or update packages (pkg update, pkg install, or even pkg bootstrap), it fails.

Installed Packages
Available Packages
Packages
×
Unable to retrieve package information.

C:\Users\pc>tracert services.netgate.com

Tracing route to zuul-services-vip.atx.netgate.com [208.123.73.87]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms C:\Users\test>tracert services.netgate.com

Tracing route to zuul-services-vip.atx.netgate.com [208.123.73.87]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms x.x.x.x my ip pfSense
2 9 ms 8 ms 8 ms x.x.x.x my gateway
3 15 ms 15 ms 15 ms ISP IP
4 31 ms 30 ms 29 ms 100ge0-78.core3.zag1.he.net [184.104.193.114]
5 29 ms 29 ms 28 ms port-channel1.core1.zag2.he.net [184.105.222.102]
6 * * 35 ms 100ge0-70.core2.mil2.he.net [184.105.65.58]
7 * * * Request timed out.
8 * * * Request timed out.
9 * * 117 ms port-channel4.core2.orf2.he.net [184.104.188.213]
10 * * 122 ms port-channel1.core3.ash1.he.net [184.105.222.173]
11 * * * Request timed out.
12 * * * Request timed out.
13 * * * Request timed out.
14 * * * Request timed out.
15 * * * Request timed out.
16 * * * Request timed out.
17 * * * Request timed out.
18 * * * Request timed out.
19 * * * Request timed out.
20 * * * Request timed out.

Gertjan

@rootCRO

The IP, 208.123.73.87, is correct, so DNS works.
ping packets pass just fone, although ICMP isn't important here.
The tracert does end for me at the correct address :

C:\Users\Gauche>tracert services.netgate.com

Détermination de l’itinéraire vers zuul-services-vip.atx.netgate.com [208.123.73.87]
avec un maximum de 30 sauts :

  1    <1 ms    <1 ms    <1 ms  pfSense.bhf.tld [192.168.1.1]
  2    <1 ms    <1 ms    <1 ms  192.168.10.1
  3     3 ms     3 ms     2 ms  80.10.239.117
  4    22 ms    21 ms    21 ms  lag-11.neagn00z.rbci.orange.net [80.10.45.206]
  5    21 ms    21 ms    21 ms  ae93-0.ncbor202.rbci.orange.net [80.10.45.86]
  6     *        *        *     Délai d’attente de la demande dépassé.
  7     *        *        *     Délai d’attente de la demande dépassé.
  8     *        *        *     Délai d’attente de la demande dépassé.
  9     *        *        *     Délai d’attente de la demande dépassé.
 10    21 ms     *        *     ae35.ear2.par1.sp.lumen.tech [4.68.127.233]
 11     *        *        *     Délai d’attente de la demande dépassé.
 12   132 ms   132 ms   143 ms  ZAYO-BANDWI.ear5.Dallas1.Level3.net [4.14.49.2]
 13   128 ms   137 ms   129 ms  net66-219-34-198.static-customer.corenap.com [66.219.34.198]
 14   131 ms   131 ms   131 ms  fw1-zcolo.netgate.com [208.123.73.4]
 15   132 ms   132 ms   131 ms  services.netgate.com [208.123.73.87]

Look like nothing is wrong on your 'pfSense side' of things.
Not sure why, the route on the other side just seems to stop for you.

edit : and pfSense doesn't pull anything from "http://pkg.freebsd.org/" because pfSense is based upon FreebSD, true, but it isn't FreeBSD so it doesn't (can't !! should not !!) use the FreeBSD repository.

rootCRO

@Gertjan Then where does pfSense actually pull its packages from?

I think this is connected to the issue I'm having — I can’t install pfSense 2.8 at all, and on 2.7.2 I also can’t install any packages.

pfSense 2.8

pfSense 2.72

I can also reach 208.123.73.87 from another IP address (different network, different Internet provider, and a different location).

*tracert 208.123.73.87

Tracing route to services.netgate.com [208.123.73.87]
over a maximum of 30 hops:

*1 2 ms 2 ms 2 ms ...
.
.
.

12 155 ms 155 ms 155 ms services.netgate.com [208.123.73.87]

Trace complete.*

Do you think this could be an issue with my ISP?

I’d really like to know exactly where pfSense pulls its packages from, and what address my WAN needs to contact in order to download packages and access Netgate Services and Support.

Gertjan

@rootCRO said in pfSense 2.8 Installation Fails, and 2.7.2 Cannot Fetch pkg Packages – Repository Unreachable”:

services.netgate.com

Where did you get that "services.netgate.com" host name from ?

Here is the forum that handles the 'install' questions : Home > pfSense Software > Problems Installing or Upgrading pfSense Software.

@rootCRO said in pfSense 2.8 Installation Fails, and 2.7.2 Cannot Fetch pkg Packages – Repository Unreachable”:

I’d really like to know exactly where pfSense pulls its packages from

FreeBSD: { enabled: no }

pfSense-core: {
    url: "pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v25_07_1_amd64-core",
    mirror_type: "srv",
    signature_type: "fingerprints",
    fingerprints: "/usr/local/share/pfSense/keys/pkg",
    enabled: yes
}

pfSense: {
    url: "pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v25_07_1_amd64-pfSense_plus_v25_07_1",
    mirror_type: "srv",
    signature_type: "fingerprints",
    fingerprints: "/usr/local/share/pfSense/keys/pkg",
    enabled: yes
}

I'm using pfSense plus.

Be ware : you can't point a web browser to URL like https://pfsense-plus-pkg.netgate.com/pfSense_plus-v25_07_1_amd64-pfSense_plus_v25_07_1, as it is not a web server.