Opkg update failed to download

maxbarjr · April 20, 2022, 12:11pm

root@OpenWrt:~# opkg update
Downloading https://downloads.openwrt.org/snapshots/targets/bcm27xx/bcm2710/packages/Packages.gz
Failed to send request: Operation not permitted
*** Failed to download the package list from https://downloads.openwrt.org/snapshots/targets/bcm27xx/bcm2710/packages/Packages.gz

Downloading https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/base/Packages.gz
Failed to send request: Operation not permitted
*** Failed to download the package list from https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/base/Packages.gz

Via ssh this is what I get. But internet is working. Changed ip address, gateway and dns in /etc/config/network.

frollic · April 20, 2022, 12:25pm

From where?

Your lan and wan ips arent by and chance on the same subnet?

Or no/incorrect gw defined ?

Post your /etc/config/network

maxbarjr · April 20, 2022, 12:29pm

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdff:c456:212e::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'
        option gateway '192.168.10.254'
        option dns '1.1.1.2'

root@OpenWrt:~#

trendy · April 20, 2022, 12:44pm

Is firewall allowing the outgoing traffic?
uci export firewall; iptables-save -c

maxbarjr · April 20, 2022, 12:49pm

This is a new install on a Raspberry Pi 3b+. When I ping my gateway, it's successful. When I ping openwrt.org, it's successful. When I ping downloads.openwrt.org is NOT successful.

ambarusa · April 20, 2022, 1:18pm

I don't understand, where is your wan interface? can you also show your /etc/config/firewall?

frollic · April 20, 2022, 2:08pm

What @ambarusa said, do you have an additional NIC?

ambarusa · April 20, 2022, 2:29pm

I think it still should appear in network, right?

frollic · April 20, 2022, 3:18pm

Only if the correct kmods are there...

maxbarjr · April 20, 2022, 10:33pm

As I said, I just installed openWRT for RPI3B+ and just using the NIC of the pi. I have not added any USB to Ethernet yet and I am just updating the packages to install the StarTech USB to Ethernet driver.

maxbarjr · April 20, 2022, 10:37pm

root@OpenWrt:~# cat /etc/config/firewall
config defaults
        option syn_flood        1
        option input            ACCEPT
        option output           ACCEPT
        option forward          REJECT
# Uncomment this line to disable ipv6 rules
#       option disable_ipv6     1

config zone
        option name             lan
        list   network          'lan'
        option input            ACCEPT
        option output           ACCEPT
        option forward          ACCEPT

config zone
        option name             wan
        list   network          'wan'
        list   network          'wan6'
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
        option masq             1
        option mtu_fix          1

config forwarding
        option src              lan
        option dest             wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
        option name             Allow-DHCP-Renew
        option src              wan
        option proto            udp
        option dest_port        68
        option target           ACCEPT
        option family           ipv4

# Allow IPv4 ping
config rule
        option name             Allow-Ping
        option src              wan
        option proto            icmp
        option icmp_type        echo-request
        option family           ipv4
        option target           ACCEPT

config rule
        option name             Allow-IGMP
        option src              wan
        option proto            igmp
        option family           ipv4
        option target           ACCEPT

# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
config rule
        option name             Allow-DHCPv6
        option src              wan
        option proto            udp
        option src_ip           fc00::/6
        option dest_ip          fc00::/6
        option dest_port        546
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-MLD
        option src              wan
        option proto            icmp
        option src_ip           fe80::/10
        list icmp_type          '130/0'
        list icmp_type          '131/0'
        list icmp_type          '132/0'
        list icmp_type          '143/0'
        option family           ipv6
        option target           ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Input
        option src              wan
        option proto    icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        list icmp_type          router-solicitation
        list icmp_type          neighbour-solicitation
        list icmp_type          router-advertisement
        list icmp_type          neighbour-advertisement
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Forward
        option src              wan
        option dest             *
        option proto            icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-IPSec-ESP
        option src              wan
        option dest             lan
        option proto            esp
        option target           ACCEPT

config rule
        option name             Allow-ISAKMP
        option src              wan
        option dest             lan
        option dest_port        500
        option proto            udp
        option target           ACCEPT


### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option dest             wan
#       option proto    tcp
#       option target   REJECT

# block a specific mac on wan
#config rule
#       option dest             wan
#       option src_mac  00:11:22:33:44:66
#       option target   REJECT

# block incoming ICMP traffic on a zone
#config rule
#       option src              lan
#       option proto    ICMP
#       option target   DROP

# port redirect port coming in on wan to lan
#config redirect
#       option src                      wan
#       option src_dport        80
#       option dest                     lan
#       option dest_ip          192.168.16.235
#       option dest_port        80
#       option proto            tcp

# port redirect of remapped ssh port (22001) on wan
#config redirect
#       option src              wan
#       option src_dport        22001
#       option dest             lan
#       option dest_port        22
#       option proto            tcp

### FULL CONFIG SECTIONS
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port 80
#       option dest             wan
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp
#       option target   REJECT

#config redirect
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port         1024
#       option src_dport        80
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp
root@OpenWrt:~#

frollic · April 21, 2022, 2:31am

what if you replace your static LAN IP with DHCP client ?

maxbarjr · April 21, 2022, 3:07am

Sorry to ask but how do I set the lan to dhcp?

frollic · April 21, 2022, 3:24am

maxbarjr:

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'
        option gateway '192.168.10.254'
        option dns '1.1.1.2'

Change option proto to dhcp, delete all the other option after that line, in the lan section.

maxbarjr · April 21, 2022, 7:48am

Ok, I followed your advice, reboot the pi and ssh into the new dhcp ip of the pi. Did the opkg update again and this is the result;

root@OpenWrt:~# opkg update
Downloading https://downloads.openwrt.org/snapshots/targets/bcm27xx/bcm2710/packages/Packages.gz
Failed to send request: Operation not permitted
*** Failed to download the package list from https://downloads.openwrt.org/snapshots/targets/bcm27xx/bcm2710/packages/Packages.gz

Downloading https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/base/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_base
Downloading https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/base/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/snapshots/targets/bcm27xx/bcm2710/kmods/5.10.111-1-732dd1ce27d3ef9caa14a9221362fecb/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_kmods
Downloading https://downloads.openwrt.org/snapshots/targets/bcm27xx/bcm2710/kmods/5.10.111-1-732dd1ce27d3ef9caa14a9221362fecb/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/luci/Packages.gz
Failed to send request: Operation not permitted
*** Failed to download the package list from https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/luci/Packages.gz

Downloading https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/packages/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_packages
Downloading https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/packages/Packages.sig
Failed to send request: Operation not permitted
Signature file download failed.
Remove wrong Signature file.
Downloading https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/routing/Packages.gz
Failed to send request: Operation not permitted
*** Failed to download the package list from https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/routing/Packages.gz

Downloading https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/telephony/Packages.gz
Failed to send request: Operation not permitted
*** Failed to download the package list from https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/telephony/Packages.gz

Collected errors:
 * opkg_download: Failed to download https://downloads.openwrt.org/snapshots/targets/bcm27xx/bcm2710/packages/Packages.gz, wget returned 4.
 * opkg_download: Check your network settings and connectivity.

 * opkg_download: Failed to download https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/luci/Packages.gz, wget returned 4.
 * opkg_download: Check your network settings and connectivity.

 * opkg_download: Failed to download https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/packages/Packages.sig, wget returned 4.
 * opkg_download: Check your network settings and connectivity.

 * opkg_download: Failed to download https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/routing/Packages.gz, wget returned 4.
 * opkg_download: Check your network settings and connectivity.

 * opkg_download: Failed to download https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/telephony/Packages.gz, wget returned 4.
 * opkg_download: Check your network settings and connectivity.

root@OpenWrt:~#

anon89577378 · April 21, 2022, 8:09am

I've been able to download several of the packages that show as failed in your log.

If you're using something like Wireguard, try whitelisting downloads.openwrt.org

maxbarjr · April 21, 2022, 8:27am

Not using something like that although, I have a plan on using openwrt with adguard home later if this works.

anon89577378 · April 21, 2022, 8:31am

SSH in and run nslookup downloads.openwrt.org

Post the results.

anon89577378 · April 21, 2022, 8:39am

https://downloads.openwrt.org/snapshots/targets/bcm27xx/bcm2710/packages/Packages.gz
Failed to send request: Operation not permitted

c0s · April 21, 2022, 8:43am

change your dns in /etc/resolv.conf then run opkg update