2.1.5 to 2.2 BETA

xbipin

is it safe to upgrade all my nanobsd alix boxes to 2.2 BETA from 2.1.5 for testing etc?

does the upgrade go well or clean install and config restore is required?

i want to get on the 2.2 BETA wagon as its been quiet some time since i was away so wanted to test beta and i dont mind few minor things broken here and there as long as the below thigns work fine enough
DNS forwarder
DDNS
NAT
Limiter
firewall rules
traffic shaper
DHCP server
OpenVPN client
Cron package

phil.davis

I am happily running 2.2-BETA at home, and have used all the things you list except traffic shaper.
My upgrade from 2.1.n was fine a few months ago, so I expect the upgrade code is still working fine.

The only thing I can think of is that on OpenVPN clients you might want to check the "Infinitely resolve server" box - "resolve-retry 2" is now the default for clients. I have 2 OpenVPN site-to-site clients from home up to offices and they would give up too easily when my home ISP had connectivity/DNS resolution issues.
Edit: As cmb says, that behavior has changed back now

It will be safe from an OHS perspective - you won't electrocute yourself or start a fire!

cmb

I'm not aware of any upgrade issues. Everything you listed there has been tested pretty thoroughly.

@phil.davis:

The only thing I can think of is that on OpenVPN clients you might want to check the "Infinitely resolve server" box - "resolve-retry 2" is now the default for clients. I have 2 OpenVPN site-to-site clients from home up to offices and they would give up too easily when my home ISP had connectivity/DNS resolution issues.

That's gone back to its former default now for exactly that reason.

xbipin

ok great, ill try it out and report in case of issues

wbennett77

1 - Could someone explain the best way(s) to UPGRADE from 2.15 to 2.2 beta? Is it possible to do it online?

2 - If I decide to wait for the final version of 2.2 to be released will it show up as an online update?

Sorry for the newbie question….still learning.

Thanks!

phil.davis

Right now the first 2.2-RC is being made, so I would wait just a little while (1 day, or maybe hours?). There should be a post at the top of this forum to announce where you can update from - i.e. what to put in System->Firmware, Updater Settings, Firmware Auto Update URL…

JasonJoel

After reviewing the outstanding issues list, I manually upgraded from 2.1.5 to 2.2 the other day. Everything worked fine (followed the normal manual upgrade instructions - can google them).

wbennett77

Thanks for the responses. I am using pfBlocker, OpenVpn Client and Snort. Is anyone having any problems with these packages on 2.2?

Thanks!

cmb

Those packages all work.

xbipin

here are some errors that showed up in serial console after upgrading

NanoBSD Firmware upgrade is complete.  Rebooting in 10 seconds.

*** FINAL System shutdown message from root@ ***

System going down IMMEDIATELY

pfSense is now shutting down ...

ovpnc1: link state changed to DOWN
pflog0: promiscuous mode enabled
pflog0: promiscuous mode disabled
Waiting (max 60 seconds) for system process `vnlru' to stop...done
Waiting (max 60 seconds) for system process `bufdaemon' to stop...done
Waiting (max 60 seconds) for system process `syncer' to stop...
Syncing disks, vnodes remaining...0 0 done
All buffers synced.
Uptime: 23h34m15s
usbus0: Controller shutdown
usbus0: Controller shutdown complete
usbus1: Controller shutdown
usbus1: Controller shutdown complete
Rebooting...
PC Engines ALIX.2 v0.99h
640 KB Base Memory
261120 KB Extended Memory

01F0 Master 044A CF 1GB
Phys C/H/S 2015/16/63 Log C/H/S 1007/32/63

1  pfSense
2  pfSense

F6 PXE
Boot:  2
\ô´ÿ÷ßÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ‚AƒÃÿûÿÿÿÿ›W
öÊa×ÓW#Áÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿTÕÔÿÿÿÿÿÿÿÿÿÿÿÿ/boot/kernel/kernel text=0x11ef588 data=0x832d70+0x279e60 syms
=[0x4+0xf3410+0x4+0x16b437]

Hit [Enter] to boot immediately, or any other key for command prompt.
Booting [/boot/kernel/kernel]...
KDB: debugger backends: ddb
KDB: current backend: ddb
Copyright (c) 1992-2014 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 10.1-RELEASE #0 29f4af5(releng/10.1)-dirty: Thu Dec  4 09:01:35 CST 2014
    root@pfsense-22-i386-builder:/usr/obj.i386/usr/pfSensesrc/src/sys/pfSense_wr
ap.10.i386 i386
FreeBSD clang version 3.4.1 (tags/RELEASE_34/dot1-final 208032) 20140512
VT: running with driver "vga".
CPU: Geode(TM) Integrated Processor by AMD PCS (498.06-MHz 586-class CPU)
  Origin = "AuthenticAMD"  Id = 0x5a2  Family = 0x5  Model = 0xa  Stepping = 2
  Features=0x88a93d <fpu,de,pse,tsc,msr,cx8,sep,pge,cmov,clflush,mmx>AMD Features=0xc0400000 <mmx+,3dnow!+,3dnow!>real memory  = 268435456 (256 MB)
avail memory = 226209792 (215 MB)
pnpbios: Bad PnP BIOS data checksum
random device not loaded; using insecure entropy
ipw_bss: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw/.
ipw_bss: If you agree with the license, set legal.intel_ipw.license_ack=1 in /bo
ot/loader.conf.
module_register_init: MOD_LOAD (ipw_bss_fw, 0xc0809390, 0) error 1
ipw_ibss: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw/.
ipw_ibss: If you agree with the license, set legal.intel_ipw.license_ack=1 in /b
oot/loader.conf.
module_register_init: MOD_LOAD (ipw_ibss_fw, 0xc0809440, 0) error 1
ipw_monitor: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw
/.
ipw_monitor: If you agree with the license, set legal.intel_ipw.license_ack=1 in
 /boot/loader.conf.
module_register_init: MOD_LOAD (ipw_monitor_fw, 0xc08094f0, 0) error 1
iwi_bss: You need to read the LICENSE file in /usr/share/doc/legal/intel_iwi/.
iwi_bss: If you agree with the license, set legal.intel_iwi.license_ack=1 in /bo
ot/loader.conf.
module_register_init: MOD_LOAD (iwi_bss_fw, 0xc0831b20, 0) error 1
iwi_ibss: You need to read the LICENSE file in /usr/share/doc/legal/intel_iwi/.
iwi_ibss: If you agree with the license, set legal.intel_iwi.license_ack=1 in /b
oot/loader.conf.
module_register_init: MOD_LOAD (iwi_ibss_fw, 0xc0831bd0, 0) error 1
iwi_monitor: You need to read the LICENSE file in /usr/share/doc/legal/intel_iwi
/.
iwi_monitor: If you agree with the license, set legal.intel_iwi.license_ack=1 in
 /boot/loader.conf.
module_register_init: MOD_LOAD (iwi_monitor_fw, 0xc0831c80, 0) error 1
wlan: mac acl policy registered
kbd0 at kbdmux0
K6-family MTRR support enabled (2 registers)
random: <software, yarrow="">initialized
ACPI BIOS Error (bug): A valid RSDP was not found (20130823/tbxfroot-223)
ACPI: Table initialisation failed: AE_NOT_FOUND
ACPI: Try disabling either ACPI or apic support.
cryptosoft0: <software crypto="">on motherboard
padlock0: No ACE support.
pcib0 pcibus 0 on motherboard
pci0: <pci bus="">on pcib0
Geode LX: PC Engines ALIX.2 v0.99h tinyBIOS V1.4a (C)1997-2007
pci0: <encrypt decrypt,="" entertainment="" crypto="">at device 1.2 (no driver attached)
vr0: <via 10="" vt6105m="" rhine="" iii="" 100basetx="">port 0x1000-0x10ff mem 0xe0000000-0xe0
0000ff irq 10 at device 9.0 on pci0
vr0: Quirks: 0x2
vr0: Revision: 0x96
miibus0: <mii bus="">on vr0
ukphy0: <generic ieee="" 802.3u="" media="" interface="">PHY 1 on miibus0
ukphy0:  none, 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto, auto-flow
vr1: <via 10="" vt6105m="" rhine="" iii="" 100basetx="">port 0x1400-0x14ff mem 0xe0040000-0xe0
0400ff irq 11 at device 10.0 on pci0
vr1: Quirks: 0x2
vr1: Revision: 0x96
miibus1: <mii bus="">on vr1
ukphy1: <generic ieee="" 802.3u="" media="" interface="">PHY 1 on miibus1
ukphy1:  none, 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto, auto-flow
vr2: <via 10="" vt6105m="" rhine="" iii="" 100basetx="">port 0x1800-0x18ff mem 0xe0080000-0xe0
0800ff irq 15 at device 11.0 on pci0
vr2: Quirks: 0x2
vr2: Revision: 0x96
miibus2: <mii bus="">on vr2
ukphy2: <generic ieee="" 802.3u="" media="" interface="">PHY 1 on miibus2
ukphy2:  none, 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto, auto-flow
ath0: <atheros 5413="">mem 0xe00c0000-0xe00cffff irq 9 at device 12.0 on pci0
ath0: AR5413 mac 10.5 RF5413 phy 6.1
ath0: 2GHz radio: 0x0000; 5GHz radio: 0x0063
isab0: <pci-isa bridge="">port 0x6000-0x6007,0x6100-0x61ff,0x6200-0x623f,0x9d00-0x
9d7f,0x9c00-0x9c3f at device 15.0 on pci0
isa0: <isa bus="">on isab0
atapci0: <amd cs5536="" udma100="" controller="">port 0x1f0-0x1f7,0x3f6,0x170-0x177,0x37
6,0xff00-0xff0f at device 15.2 on pci0
ata0: <ata channel="">at channel 0 on atapci0
ata1: <ata channel="">at channel 1 on atapci0
ohci0: <ohci (generic)="" usb="" controller="">mem 0xefffe000-0xefffefff irq 12 at devic
e 15.4 on pci0
usbus0 on ohci0
ehci0: <amd cs5536="" (geode)="" usb="" 2.0="" controller="">mem 0xefffd000-0xefffdfff irq 12
at device 15.5 on pci0
usbus1: EHCI version 1.0
usbus1 on ehci0
cpu0 on motherboard
pmtimer0 on isa0
orm0: <isa option="" rom="">at iomem 0xe0000-0xea7ff pnpid ORM0000 on isa0
atrtc0: <at realtime="" clock="">at port 0x70 irq 8 on isa0
Event timer "RTC" frequency 32768 Hz quality 0
attimer0: <at timer="">at port 0x40 on isa0
Timecounter "i8254" frequency 1193182 Hz quality 0
Event timer "i8254" frequency 1193182 Hz quality 100
ppc0: parallel port not found.
uart0: <16550 or compatible> at port 0x3f8-0x3ff irq 4 flags 0x10 on isa0
uart0: console (9600,n,8,1)
uart1: <16550 or compatible> at port 0x2f8-0x2ff irq 3 on isa0
Timecounters tick every 1.000 msec
IPsec: Initialized Security Association Processing.
usbus0: 12Mbps Full Speed USB v1.0
usbus1: 480Mbps High Speed USB v2.0
ugen0.1: <amd>at usbus0
uhub0: <amd 1="" 9="" ohci="" root="" hub,="" class="" 0,="" rev="" 1.00="" 1.00,="" addr="">on usbus0
ugen1.1: <amd>at usbus1
uhub1: <amd 1="" 9="" ehci="" root="" hub,="" class="" 0,="" rev="" 2.00="" 1.00,="" addr="">on usbus1
ada0 at ata0 bus 0 scbus0 target 0 lun 0
ada0: <cf 20071116="" 1gb="">ATA-0 device
ada0: Serial Number TSS20036081218011525
ada0: 16.700MB/s transfers (PIO4, PIO 512bytes)
ada0: 991MB (2031120 512 byte sectors: 16H 63S/T 2015C)
ada0: Previously was known as ad0
random: unblocking device.
Timecounter "TSC" frequency 498060762 Hz quality 800
uhub0: 4 ports with 4 removable, self powered
Root mount waiting for: usbus1
Root mount waiting for: usbus1
uhub1: 4 ports with 4 removable, self powered
Trying to mount root from ufs:/dev/ufs/pfsense1 [ro]...
Configuring crash dumps...
Mounting filesystems...
Setting up memory disks... done.

     ___
 ___/ f \
/ p \___/ Sense
\___/   \
    \___/

Welcome to pfSense 2.2-BETA  ...

Creating symlinks......ELF ldconfig path: /lib /usr/lib /usr/lib/compat /usr/loc
al/lib
a.out ldconfig path: /usr/lib/aout /usr/lib/compat/aout
done.
>>> Under 512 megabytes of ram detected.  Not enabling APC.
External config loader 1.0 is now starting...
Launching the init system... done.
Initializing...................... done.
Starting device manager (devd)...done.
Loading configuration......done.
Updating configuration..................done.
Cleaning backup cache...done.
Setting up extended sysctls...sysctl: empty numeric value
sysctl: oid 'hw.bce.tso_enable' is a read only tunable
sysctl: Tunable values are set in /boot/loader.conf
sysctl: empty numeric value
sysctl: oid 'hw.bce.tso_enable' is a read only tunable
sysctl: Tunable values are set in /boot/loader.conf
done.
Setting timezone...done.
Configuring loopback interface...done.
Starting syslog...done.
Starting Secure Shell Services...done.
Setting up polling defaults...done.
Setting up interfaces microcode...done.
Configuring loopback interface...done.
Creating wireless clone interfaces...done.
Configuring LAGG interfaces...done.
Configuring VLAN interfaces...done.
Configuring QinQ interfaces...done.
Configuring WAN interface...done.
Configuring LAN interface...done.
Configuring CARP settings...done.
Syncing OpenVPN settings...done.
Configuring firewall..DUMMYNET 0 with IPv6 initialized (100409)
load_dn_sched dn_sched FIFO loaded
load_dn_sched dn_sched QFQ loaded
load_dn_sched dn_sched RR loaded
load_dn_sched dn_sched WF2Q+ loaded
load_dn_sched dn_sched PRIO loaded
....done.
Starting PFLOG...done.
Setting up gateway monitors...done.
Synchronizing user settings...done.
Starting webConfigurator...done.
Configuring CRON...done.
Starting DNS forwarder...done.
Starting NTP time client...done.
Starting DHCP service...done.
Configuring firewall......done.
Generating RRD graphs...done.
kldload: can't load cpufreq: No such file or directory
One moment please, reinstalling packages...
 >>> Trying to fetch package info...
 >>> Unable to communicate with https://packages.pfsense.org. Please verify DNS
and interface configuration, and that pfSense has functional Internet connectivi
ty.
Starting syslog...done.
Starting CRON... done.
 Starting package Cron...

done.
pfSense (nanobsd) 2.2-BETA i386 Thu Dec 04 08:23:23 CST 2014
Bootup complete

FreeBSD/i386 (firewall) (ttyu0)

*** Welcome to pfSense 2.2-BETA-nanobsd (i386) on firewall ***</cf></amd></amd></amd></amd></at></at></isa></amd></ohci></ata></ata></amd></isa></pci-isa></atheros></generic></mii></via></generic></mii></via></generic></mii></via></encrypt></pci></software></software,></mmx+,3dnow!+,3dnow!></fpu,de,pse,tsc,msr,cx8,sep,pge,cmov,clflush,mmx>

xbipin

notice the broken text after boot: 2 and other symlink and sysctl errors.
even cron doesnt install after upgrade, tried manually installing it but says installation halted

xbipin

cron install log

Beginning package installation for Cron .
Downloading package configuration file... done.
Saving updated package information... done.
Downloading Cron and its dependencies... 
Loading package configuration... done.
Configuring package components...
Loading package configuration... done.
Additional files... cron.inc failed.
Loading package instructions...
Include cron.inc is missing!
Removing package...
Removing Cron components...
Tabs items... done.
Menu items... done.
Services... done.
Loading package instructions...
Include file cron.inc could not be found for inclusion.
Deinstall commands... 
Not executing custom deinstall hook because an include is missing.
Removing package instructions...done.
Auxiliary files... done.
Package XML... done.
Configuration... done.
done.
Failed to install package.

Installation halted.

systemlog says this

Dec 7 10:29:37 	php-fpm[23690]: /pkg_mgr_install.php: XML_RPC_Client: Connection to RPC server packages.pfsense.org:443 failed. Operation timed out 103
Dec 7 10:29:37 	php-fpm[23690]: /pkg_mgr_install.php: XMLRPC communication error: Operation timed out

xbipin

other minor aesthetic bug i noticed in serial console was, after finishing boot, it usually lists all the interfaces with their ips and then the serial console option list but misses a empty line between the interface list and console options

*** Welcome to pfSense 2.2-BETA-nanobsd (i386) on firewall ***

 WAN (wan)       -> pppoe0     -> v4/PPPoE: x.x.x.x/32
 LAN (lan)       -> vr0        -> v4: 192.168.0.1/24
 VPN (opt2)      -> ovpnc1     -> v4: 10.13.0.6/32
 0) Logout (SSH only)                  9) pfTop
 1) Assign Interfaces                 10) Filter Logs
 2) Set interface(s) IP address       11) Restart webConfigurator
 3) Reset webConfigurator password    12) pfSense Developer Shell
 4) Reset to factory defaults         13) Upgrade from console
 5) Reboot system                     14) Enable Secure Shell (sshd)
 6) Halt system                       15) Restore recent configuration
 7) Ping host                         16) Restart PHP-FPM
 8) Shell

Enter an option:

wbennett77

@phil.davis:

Right now the first 2.2-RC is being made, so I would wait just a little while (1 day, or maybe hours?). There should be a post at the top of this forum to announce where you can update from - i.e. what to put in System->Firmware, Updater Settings, Firmware Auto Update URL…

Just wondering what I will see using the Firmware Auto Update URL? Will it simply download and install the upgrade and just reboot into the GUI where I would just login and go? Are any settings/packages lost? Do I need to uninstall any packages before the upgrade? Sorry for all the questions and thanks for your help.

phil.davis

other minor aesthetic bug i noticed in serial console was, after finishing boot, it usually lists all the interfaces with their ips and then the serial console option list but misses a empty line between the interface list and console options

That blank line was removed in this commit:
https://github.com/pfsense/pfsense/commit/a3cc8dcc600d105d73eb4729c32433d40d72cab7
I have no idea if it was really intentional - 2 (echo "") were needed to make a blank line, the first one just puts a new line at the end of the rc.banner output and list of interfaces, the 2nd one made the blank line.

phil.davis

Just wondering what I will see using the Firmware Auto Update URL? Will it simply download and install the upgrade and just reboot into the GUI where I would just login and go? Are any settings/packages lost? Do I need to uninstall any packages before the upgrade? Sorry for all the questions and thanks for your help.

It runs like any normal upgrade - download and install of base firmware image, reboot, download and (re)install all packages.
You should be able to just do it - make a backup first, other than that no special preparation needed.

wbennett77

@phil.davis:

Just wondering what I will see using the Firmware Auto Update URL? Will it simply download and install the upgrade and just reboot into the GUI where I would just login and go? Are any settings/packages lost? Do I need to uninstall any packages before the upgrade? Sorry for all the questions and thanks for your help.

It runs like any normal upgrade - download and install of base firmware image, reboot, download and (re)install all packages.
You should be able to just do it - make a backup first, other than that no special preparation needed.

One last question. How large is/are the download files? I have 15Mbps down and would like to have an idea how long the whole process might take (Have to keep the wife happy lol and she wll be out for awhile).

Thanks!

phil.davis

http://snapshots.pfsense.org/FreeBSD_releng/10.1/amd64/pfSense_HEAD/updates/?C=M;O=D
76MB for the nanoBSD upgrade
86MB for the full install upgrade

Internet still works during the download. (Of course, slowed by the fact that pfSense is downloading in parallel with users) It is only the reboot and package install time that really takes you off-line.

wbennett77

@phil.davis:

http://snapshots.pfsense.org/FreeBSD_releng/10.1/amd64/pfSense_HEAD/updates/?C=M;O=D
76MB for the nanoBSD upgrade
86MB for the full install upgrade

Internet still works during the download. (Of course, slowed by the fact that pfSense is downloading in parallel with users) It is only the reboot and package install time that really takes you off-line.

Does the install automatically detect the install type? I have a full install amd64.

Update: The installation was flawless and I am very happy. The new firmware seems snappier. My first impression :) :) :)!

Update2 - To show my respect, support and appreciation for this project, I just became a Gold Member.

Cheers!

xbipin

@phil.davis:

other minor aesthetic bug i noticed in serial console was, after finishing boot, it usually lists all the interfaces with their ips and then the serial console option list but misses a empty line between the interface list and console options

That blank line was removed in this commit:
https://github.com/pfsense/pfsense/commit/a3cc8dcc600d105d73eb4729c32433d40d72cab7
I have no idea if it was really intentional - 2 (echo "") were needed to make a blank line, the first one just puts a new line at the end of the rc.banner output and list of interfaces, the 2nd one made the blank line.

well the blank lines just made it look more pretty and well formated, i vote for it to return :)