Resolver/DNS issues after upgrading to OPNsense 22.7

[sed]

greetings OPNsense forum:

After upgrading to OPNsense 22.7 (upgraded via the web interface), the system->firmware->updates function and the system->firmware->status->audit connectivity tools on the OPNsense box can't seem to resolve hostnames:

Code: [Select]

***GOT REQUEST TO AUDIT CONNECTIVITY***
Currently running OPNsense 22.7_4 (amd64/OpenSSL) at Tue Aug  2 00:08:11 PDT 2022
Checking connectivity for host: pkg.opnsense.org -> 89.149.211.205
PING 89.149.211.205 (89.149.211.205): 1500 data bytes

--- 89.149.211.205 ping statistics ---
4 packets transmitted, 0 packets received, 100.0% packet loss
Checking connectivity for repository (IPv4): https://pkg.opnsense.org/FreeBSD:13:amd64/22.7
Updating OPNsense repository catalogue...
pkg: https://pkg.opnsense.org/FreeBSD:13:amd64/22.7/latest/meta.txz: Operation timed out
repository OPNsense has no meta file, using default settings
pkg: https://pkg.opnsense.org/FreeBSD:13:amd64/22.7/latest/packagesite.pkg: Operation timed out
pkg: https://pkg.opnsense.org/FreeBSD:13:amd64/22.7/latest/packagesite.txz: Operation timed out
Unable to update repository OPNsense
Error updating repositories!
Checking connectivity for host: pkg.opnsense.org -> 2001:1af8:4f00:a005:5::
ping: UDP connect: No route to host
Checking connectivity for repository (IPv6): https://pkg.opnsense.org/FreeBSD:13:amd64/22.7
Updating OPNsense repository catalogue...
pkg: https://pkg.opnsense.org/FreeBSD:13:amd64/22.7/latest/meta.txz: Non-recoverable resolver failure
repository OPNsense has no meta file, using default settings
pkg: https://pkg.opnsense.org/FreeBSD:13:amd64/22.7/latest/packagesite.pkg: Non-recoverable resolver failure
pkg: https://pkg.opnsense.org/FreeBSD:13:amd64/22.7/latest/packagesite.txz: Non-recoverable resolver failure
Unable to update repository OPNsense
Error updating repositories!
***DONE***
I can ssh onto the OPNsense box and resolve hostnames by typing a command like:

$ host pkg.opnsense.org 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:

pkg.opnsense.org has address 89.149.211.205
pkg.opnsense.org has IPv6 address 2001:1af8:4f00:a005:5::
$

I can also resolve that hostname pkg.opnsense.org by pasting it into the System->Diagnostics->DNS Lookup tool, with the Server field set to 127.0.0.1 or left blank.

I've tried switching between unbound dns and dnsmasq (currently back at unbound dns), and I've tried assigning specific gateways to each nameserver in the system-wide DNS settings, with reboots after saving each change...But the OPNsense updates feature and connectivity audit can't seem to resolve the hostnames that they need to operate correctly.

Thanks very much for any hints anyone might have about resolving this resolving issue!

--sean

[franco]

Looking at the connectivity audit your issue is not DNS... it's actually much simpler:

4 packets transmitted, 0 packets received, 100.0% packet loss

The firewall itself can't connect the package server. Maybe it's attempting to route these into a "default" that doesn't respond to the packets. Usually these should go out a WAN interface at least.


Cheers,
Franco