Big problems since 23.1 update (update checks, dpinger, haproxy)

[BlackJub]

Hello,

I updated to 21.3_6 today (from 22.7.11), and unfortunately ran into some issues :

First one: update check will throw a fetch timeout message, changelog truncated, then the process stays stuck minutes and minutes, seems to check for package updates, but will not display the usual pop-up indicating that there's no update. The wheel in the update tabs won't stop turning.
Also, the plugins tab will mark every plugin I have installed as "orphaned". I can't see any available plugin either.

Second one: I am unable to save any changes to my HAProxy service.
"Test Syntax" button will show the loading wheel turning forever. No pop-up telling me that my changes are OK or need to be corrected.
Same for the "Apply" button: the loading wheel turns forever, and the changes will never be applied.

Third one: after a reboot, the dpinger service on my IPv6 gateway will never start. I have to do so manually.
(The dpinger on the IPv4 gateway has no problem starting)

Any help solving these issues would be very appreciated!
Thanks in advance!

[tmager]

I ran into those first two issues you mentioned after the upgrade as well. Unfortunately my notes on how I fixed it aren't very good - they're intermixed with debugging a separate issue WireGuard-related issue - but I think (see edit) the fix may have been resetting all tunables to their default values, then rebooting. Definitely make a backup, though.

EDIT: My memory was jogged by another thread - the other thing that may have been the cause was an issue with WireGuard overwriting the default DNS server (see https://forum.opnsense.org/index.php?topic=23591.msg112239#msg112239), which breaks HAProxy and various other things. If you're running WireGuard, look through your local endpoints and see if any of them have a custom DNS server set. I think this is the more likely solution than the original one.

Good luck.

[Cerberus]

Timeout in package management looks like an IPv6 issue, same for the dpinger6, if IPv6 is not working, dpinger6 is down.

No idea for your haproxy issue.

[BlackJub]

Thank you for both your answers.

Here is what I did, but unfortunately that changed nothing:
- I removed the explicit DNS settings in WireGuard configuration, ran a few tests, then disabled completely WireGuard, ran tests again: nothing changed. Package updates are still horribly slow to check, HAProxy changes can't be saved (but HAProxy service works fine in itself), DPinger doesn't start automatically.
- I put down IPv6 gateway, disabled IPv6 completely in OPNsense, ensured IPv4 connectivity is still maintained, rebooted, then ran the same tests: nothing changed, same problems for HAProxy and package updates.

Checking the logs, I see nothing useful :
2023-02-08T22:09:49   Error   configd.py   Timeout (120) executing : haproxy configtest   
2023-02-08T22:08:29   Error   configd.py   Timeout (120) executing : firmware remote
I can see no warning/error in Unbound logs.
Should I check another log, or run a specific test?

So far, I'm not solving much, and I'll need to change a few things in HAProxy very soon.
I might be trying to reinstall completely OPNsense and restore a backup config file, but I'd like to keep that intervention as a last resort.

[alh]

Did you find a solution? In my case I had to remove WireGuard completely. After that everything was back up and running. Spend hours troubleshooting this.

[throwaway26a]

Ditto to this. I just switched to new hardware (running opnsense on infoblox appliance) and the install went great. I'm getting intermittent DNS lookup errors when trying to check for updates or do package audits and even trying to manually revert to 23.1.8 from .10, I had to run the command ~10x for the DNS to work consistently across the downgrade process.

I have multiple IPSec tunnels, historically, I use DDNS hostnames  for the endpoints and everything has worked fine, but I'm getting DNS lookup errors in the IPSec logs so I've had to switch to IPs for the endpoints to the time-being.

Additionally, the VTI monitoring tanked and dpinger is reporting 100% loss across the VTI gateway, but traffic is still going across and BGP peers are still forming!

Considering reverting to 22.x..

[franco]

To be honest it sounds like a setup issue. Your setup is not very basic after all (dpinger and VTI tunnels, DNS intermittently failing could be multi-WAN problems).

I'd start to disable additional services until it stabilises...


Cheers,
Franco