"Unable to check for updates" again

justsomeguy6575

I have had this problem before back in the 2.01 version and the only thing that fixed it was re-installing pfsense. I now have 2.1 installed and the other day I logged in and have the same issue. I can not see any packages to install either. I have no idea why this keeps happening. The only additional packages installed are "OpenVPN Client Export Utility" and "pfBlocker". pfblocker is currently not enabled though.

Oct 17 18:02:59 php: /index.php: XMLRPC communication error: php_network_getaddresses: getaddrinfo failed: hostname nor servname provided, or not known
Oct 17 18:02:59 php: /index.php: XML_RPC_Client: Connection to proxy server admin:8080 failed. php_network_getaddresses: getaddrinfo failed: hostname nor servname provided, or not known 103

Anyone know why this may be happening?

stephenw10

If you have IPv6 enabled then you might have an issue with the box trying to use it in preference to v4.
Try this:
https://doc.pfsense.org/index.php/Controlling_IPv6_or_IPv4_Preference

Steve

justsomeguy6575

Thanks for the reply.

I ran "env ip6addrctl_enable="yes" ip6addrctl_policy="prefer_ipv4" /etc/rc.d/ip6addrctl start"at the shell (no quotes) and rebooted after. It didn't give any feedback but didn't give any errors either so I assume it worked but I still can't check for updates.

stephenw10

Ok. You have DNS OK? You can ping from the pfSense box?

Steve

justsomeguy6575

Yes I am able to ping from pfsense and it appears to be resolving hosts ok.

Ping output:

PING pfsense.org (192.207.126.26): 56 data bytes
64 bytes from 192.207.126.26: icmp_seq=0 ttl=49 time=81.034 ms
64 bytes from 192.207.126.26: icmp_seq=1 ttl=49 time=81.409 ms
64 bytes from 192.207.126.26: icmp_seq=2 ttl=49 time=80.340 ms

–- pfsense.org ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 80.340/80.928/81.409/0.443 ms

stephenw10

Is this an upgrade to 2.1 or a fresh install?
If it's an upgrade then make sure you have the correct update server selected. Go to System: Firmware: Updater Settings: and select the appropriate url from the drop down.
This is particularly important if you were running 2.1 snopshots.

Steve

justsomeguy6575

It is an upgrade. I believe I am using the correct url, http://updates.pfsense.org/_updaters ,this is the same as my other box is using.
I can't view any available addon packages either. The package manager displays "Unable to communicate with www.pfsense.com. Please verify DNS and interface configuration, and that pfSense has functional Internet connectivity."

Here are the services I have running:
apinger
dnsmasq
ntpd
openvpn
openvpn
racoon

I am also running 2 WAN interfaces set to failover from 1 to 2.

stephenw10

Hmm, OK. We've tried the usual suspects here.
You can see this behaviour in a multiwan setup with gateway groups. The clients on LAN use the gateway group to access the internet, in your case you have a failover setup. If you have firewall rules on LAN that catch all traffic and specify the gateway group then you are never using the system routing table to select a gateway. The pfSense box itself cannot use a gateway group it always uses the system routing table. Thus if it's default gateway is set incorrectly it will not be able to access the internet.
Using the ping test in the diagnostics menu will fail to find this since you have to specify which interface you want to ping from.

Go to System: Routing: Gateways: make sure the default gateway is set to something sensible, like your primary WAN connection.

Steve

justsomeguy6575

I do have all LAN traffic going through my failover group. I checked and my default gateway is set to my WAN1 interface. I switched my default to WAN2 and still couldn't check updates, switched back to WAN1 as default, rebooted and still couldn't check updates. I've attached a few screenshots but it all looks pretty basic and appears correct.

![Gateways status.jpg](/public/imported_attachments/1/Gateways status.jpg)
![Gateways status.jpg_thumb](/public/imported_attachments/1/Gateways status.jpg_thumb)
![Gateway Gp status.jpg](/public/imported_attachments/1/Gateway Gp status.jpg)
![Gateway Gp status.jpg_thumb](/public/imported_attachments/1/Gateway Gp status.jpg_thumb)
![IPv4 Rtable.jpg](/public/imported_attachments/1/IPv4 Rtable.jpg)
![IPv4 Rtable.jpg_thumb](/public/imported_attachments/1/IPv4 Rtable.jpg_thumb)

Gateways.jpg_thumb

stephenw10

Hmm, well I'm out of suggestions. :-
You could try manually downloading the package lists file and the versions file used to check for updates from the console. If you can do that then I can't see any reason why it wouldn't be working.

[2.1-RELEASE][root@pfsense.localdomain]/root(1): fetch -o /dev/null http://www.pfsense.org/packages/pkg_config.8.xml
/dev/null                                     100% of  115 kB  182 kBps
[2.1-RELEASE][root@pfsense.localdomain]/root(2): fetch -o /dev/null http://updates.pfsense.org/_updaters/version
version                                       100% of   12  B   71 kBps

Steve

justsomeguy6575

Thanks for trying to help.
I was able to manually download those files so I'm at a complete lose. Has to be some odd issue with just the right config combination I am using on this box because this has happened before with an almost identical setup. It was only resolved because I ended up doing a fresh install do to a hardware issue.

stephenw10

Hmm, well that's very odd then. I just noticed, re-reading this entire thread, that the error indicates the box is trying a proxy. Do you have an upstream proxy set? Have you ever?
Other than that I can only speculate that perhaps something odd happened during the 2.1 update. Did you have the packages installed during the update procedure? I can only suggest a fresh install. :-\

Anyone else got any ideas here?

Steve

JasonM.

@justsomeguy6575:

Has to be some odd issue with just the right config combination I am using on this box because this has happened before with an almost identical setup. It was only resolved because I ended up doing a fresh install do to a hardware issue.

I had this issue as well with 2.1. It happened to be resolving a different IP for updates.pfsense.org than my ISP's DNS was for some reason. I was able to resolve it (no pun intended) by going to System -> General Setup and checking "Do not use the DNS Forwarder as a DNS server for the firewall." This ended up with the ability to ping updates.pfsense.org from the pfsense interface and resolving to the real address of 66.111.2.169. I'd imagine its an issue with the DNS Forwarder caching something bogus.

stephenw10

That is an interesting and strange issue but I don't think it is the case here because the OP is able to fetch the versions file from updates.pfsense.org with no problem.

Steve

JasonM.

He did so from the console though, correct? Does the console skip the dns forwader even if enabled? Just a thought, I'm not very familiar with PF's internal dns routes.

stephenw10

My understanding is that the DNS handling would be the same however you make a good point. At the console you are, likely, logged in as root. The script that runs XMLRPC runs as admin, I think, hence should have similar rights etc but maybe not the same path. Hmm.

Steve

justsomeguy6575

@JasonM.:

I had this issue as well with 2.1. It happened to be resolving a different IP for updates.pfsense.org than my ISP's DNS was for some reason. I was able to resolve it (no pun intended) by going to System -> General Setup and checking "Do not use the DNS Forwarder as a DNS server for the firewall." This ended up with the ability to ping updates.pfsense.org from the pfsense interface and resolving to the real address of 66.111.2.169. I'd imagine its an issue with the DNS Forwarder caching something bogus.

I've always been able to resolve updates.pfsense.org to 66.111.2.169
I tried checking that option to not use the DNS forwarder but it didn't make any difference. I may try temporally disabling the dns forwarder completely but I'm not sure it will change anything that checking the previous option wouldn't have done.

justsomeguy6575

@stephenw10:

My understanding is that the DNS handling would be the same however you make a good point. At the console you are, likely, logged in as root. The script that runs XMLRPC runs as admin, I think, hence should have similar rights etc but maybe not the same path. Hmm.

Steve

I was logged in as root but I just logged in as admin and was still able to download the file from updates.pfsense.com

ShumaDK

Hello.
I had the same error "Unable to check for updates" and I'd like to share my case.
I figured out that for security reasons I set to bind the LAN interface only for the DNS forwarder in the "Services: DNS forwarder" section. But there is also an option "Localhost" which you can mark with "Ctrl" key pressed and the DNS forwarder begins to service pfSense's requests too, so the autoupdate feature resumes working right.

Mr. Jingles

@ShumaDK:

Hello.
I had the same error "Unable to check for updates" and I'd like to share my case.
I figured out that for security reasons I set to bind the LAN interface only for the DNS forwarder in the "Services: DNS forwarder" section. But there is also an option "Localhost" which you can mark with "Ctrl" key pressed and the DNS forwarder begins to service pfSense's requests too, so the autoupdate feature resumes working right.

That solved the problem I was having for 2 weeks. Thank you very much ;D