17.7 Refuses to Update Through Web Interface (But Slowly Updates from Console)

[rajl]

So I am evaluating OPNSense as a replacement for PFSense (not to start a flameware, but OPNSense has features that PFSense doesn't which are useful to me).  However, when I try to update the firmware through the WebGUI, it fails with the following error:

Code Select Expand


Firmware status check was aborted internally. Please try again.


The logs say:

Code Select Expand


Jan 6 15:49:03
configd.py: [4297ea6f-e1c5-46ca-a2d3-2d36f80d3f4f] view remote packages
Jan 6 15:49:03
configd.py: [8071332c-d198-42e6-a5e8-1108b8870172] retrieve firmware update status
Jan 6 15:49:03
configd.py: [21d096d3-f98e-4765-81ea-7b2afa5b15b4] returned exit status 1
Jan 6 15:48:57
configd.py: [21d096d3-f98e-4765-81ea-7b2afa5b15b4] Fetching changelog from remote
Jan 6 15:48:53
configd.py: generate template container OPNsense/Auth
Jan 6 15:48:53
configd.py: [cc2a0904-55f7-4ead-8709-c11720859c4c] generate template OPNsense/Auth
Jan 6 15:48:53
configd.py: [f12072fd-42bb-4d8a-8133-0fc01c4462a2] update firmware configuration


I did perform an update from the console, but it took forever.  I did some searching of the forums and it seems others have had this problem before, but did not say what it was.  There was some hint that it could be related to the use of a proxy, use of IPv6 by default, or other issues unspecified.  In my case, there is no proxy and I have native IPv6 enabled and working (I've tested it on other sites).

Any help?

[bartjsmit]

How much free disk space is there on the firewall?

Bart...

[phoenix]

I posted about this back in October last year, it could be a problem with IPv6, take a lake a look and see if it's the same problem: https://forum.opnsense.org/index.php?topic=6097.msg25538#msg25538

[chemlud]

"Firmware status check was aborted internally. Please try again."

I get this from time to time (IPv4, nano i386, 17.1.10 was the last I updated), but after pressing the "Update" button repeatedly I get the box to show the latest updates.

Have you tried a different update server?

[franco]

Slow/defunct IPv6 is my guess. Try to prefer IPv4 and see how that goes...


Cheers,
Franco

[rajl]

How much free disk space is there on the firewall?

Bart...

At least 100 GB (I put a spare 128 GB Samsung 830 I had lying around in there as the install/boot drive)

[rajl]

I posted about this back in October last year, it could be a problem with IPv6, take a lake a look and see if it's the same problem: https://forum.opnsense.org/index.php?topic=6097.msg25538#msg25538

It could be, but I hope not.  I will test sometime this week and report back.  It would be strange if it were as my previous PFSense installation had no problems when IPv6 was preferred and my ISP provides native IPv6.

[rajl]

Slow/defunct IPv6 is my guess. Try to prefer IPv4 and see how that goes...


Cheers,
Franco

Will do and will report back.  Why would IPv6 be causing this issue?

[franco]

Because it can't resolve locally. It takes a timeout for each DNS lookup, which ends up stalling every little detail during the update process and finally running into the GUI timeout (it's only 45 seconds for the repo database fetch).

The console update option 12 should work when giving it a lot of time tough as there is no hard timeout there. It's intentional to have a very basic update script there to provide a safety net for users.


Cheers,
Franco

[rajl]

A bit late of a reply, but it works fine if I select "Prefer IPv4 over IPv6". This is mildly annoying as Inhave working IPv6.  However, I can always toggle the switch when doing an OPNSense update and use IPv6 normally for the rest of the Internet.

Any idea why IPv6 does not work well with the update server?

[nivek1612]

I update no issue with IPV6 turned on, sounds like a setting issue to me

what do you get here

http://ipv6-test.com/

[franco]

Even though your clients may have perfect internet, your ISP may not offer IPv6 servers to the box and if you don't allow the box to access the local DNS service or the servers you entered are not IPv6-capable you get this behaviour.

System: Settings: General at the bottom.... uncheck the option that prevents system resolution against the configured DNS server.


Cheers,
Franco

[franco]

PS: Hmm, or maybe IPv6 resolution works fine but the system can't route IPv6... A simple ping6 test will reveal this.

[nivek1612]

System: Settings: General at the bottom.... uncheck the option that prevents system resolution against the configured DNS server.


Cheers,
Franco

I confirm I have this unchecked and have no probelems

[rajl]

PS: Hmm, or maybe IPv6 resolution works fine but the system can't route IPv6... A simple ping6 test will reveal this.

Upon further inspection, IPv6 is not working even though my WAN interface gets a native IPv6 address from the ISP's gateway.  IPv6 was working "out of the box" with my old PFSense installation, so I wonder what OPNSense is doing differently?  I will try to figure it out when I have time.