SOLVED Update Timeout

[Jochynek]

Hi,

for some time I am not getting any updates. I am on FreeNAS 11.1-U4. Clicking check update brings up this exception after some time:

Code:

Update server could not be reached

<urlopen error timed out>

Traceback (most recent call last):
File "/usr/local/lib/python3.6/urllib/request.py", line 1318, in do_open
encode_chunked=req.has_header('Transfer-encoding'))
File "/usr/local/lib/python3.6/http/client.py", line 1239, in request
self._send_request(method, url, body, headers, encode_chunked)
File "/usr/local/lib/python3.6/http/client.py", line 1285, in _send_request
self.endheaders(body, encode_chunked=encode_chunked)
File "/usr/local/lib/python3.6/http/client.py", line 1234, in endheaders
self._send_output(message_body, encode_chunked=encode_chunked)
File "/usr/local/lib/python3.6/http/client.py", line 1026, in _send_output
self.send(msg)
File "/usr/local/lib/python3.6/http/client.py", line 964, in send
self.connect()
File "/usr/local/lib/python3.6/http/client.py", line 936, in connect
(self.host,self.port), self.timeout, self.source_address)
File "/usr/local/lib/python3.6/socket.py", line 724, in create_connection
raise err
File "/usr/local/lib/python3.6/socket.py", line 713, in create_connection
sock.connect(sa)
socket.timeout: timed out

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "./freenasUI/system/views.py", line 1697, in update_check
train=updateobj.get_train(),
File "./freenasUI/system/models.py", line 599, in get_train
trains = conf.AvailableTrains() or []
File "/usr/local/lib/freenasOS/Configuration.py", line 1064, in AvailableTrains
fileref = self.TryGetNetworkFile(file=TRAIN_FILE, reason="FetchTrains")
File "/usr/local/lib/freenasOS/Configuration.py", line 787, in TryGetNetworkFile
raise url_exc
File "/usr/local/lib/freenasOS/Configuration.py", line 761, in TryGetNetworkFile
furl = opener.open(req, timeout=30)
File "/usr/local/lib/python3.6/urllib/request.py", line 526, in open
response = self._open(req, data)
File "/usr/local/lib/python3.6/urllib/request.py", line 544, in _open
'_open', req)
File "/usr/local/lib/python3.6/urllib/request.py", line 504, in _call_chain
result = func(*args)
File "/usr/local/lib/python3.6/urllib/request.py", line 1346, in http_open
return self.do_open(http.client.HTTPConnection, req)
File "/usr/local/lib/python3.6/urllib/request.py", line 1320, in do_open
raise URLError(err)
urllib.error.URLError: <urlopen error timed out>

I am on the stable train, update server is http://update.ixsystems.com/FreeNAS. I can resolve the host-name but not ping it. Verify install ends with

Code:

All files verified successfully!

I read in the forum that the update server should be pingable. I am not sure why I cannot ping it, but I am pretty sure network is fine. Are there any requirements to firewall rules for updates to work?

Thanks, regards

Jochen

 

[Alecmascot]

Yes the update server is pingable.
Fix the network.
try a traceroute and see where it dies.....

 

[Jochynek]

My network is working fine. Updates are somehow blocked by the firewall.

What are the requirements for the updates to go through?

 

[Jochynek]

enabling ICMP in the firewall makes pings work to update.ixsystems.com. Fetching updates still times out.

Code:

host update.ixsystems.com
update.ixsystems.com is an alias for update.freenas.org.
update.freenas.org is an alias for freenas-update.scaleengine.net.
freenas-update.scaleengine.net is an alias for freenas-update.secdn.net.
freenas-update.secdn.net has address 178.63.34.104
freenas-update.secdn.net has IPv6 address 2001:41d0:8:6343::1:81

allowing host 178.63.34.104 in the firewall does not change anything. It does not look like a good idea, judging from the alias cascade. This CNAME might change often...

 

[Jochynek]

Never mind, I fixed it.
As I am using a static firewall, I needed to add a rule for replies to outgoing connections.

source-ip: *
target-ip:*
source-port: *
target-port: 32768-65535
protocoll: tcp
TCP-Flags: ack

restricting this to the ip of the update server does not work.