Traffic seems to be ignoring rules
-
@spgeise Quad 9 and quad 4 are DNS servers, not NTP...You have the option to just setup the PfSense NTP server, and allow the cameras to access the VLAN 25 address(that means the pfsense address on that subnet) port 123 UDP. You can also setup the PfSense DNS Resolver and allow the cameras to access VLAN 25 address port 53 TCP/UDP.
-
@NightlyShark said in Traffic seems to be ignoring rules:
Quad 9 and quad 4 are DNS servers, not NTP...
You are correct. I was answering the other question asking if I understood about the pool address changing. By allowing access to those DNS servers, they can resolve the pool address.
@NightlyShark said in Traffic seems to be ignoring rules:
You have the option to just setup the PfSense NTP server,
I understand this as well. The problem is that, so far, I have not been able to get this to work on my camera VLAN. I'm still trying to figure out what the issue is in my rules.
I appreciate all input in this. But I would THINK that no one digging this deep into VLANs, deny rules, DNS, NTP, etc. would need to be asked if they understand the difference between the protocols.
-
@spgeise Can you please provide all rulesets from all active subnets (LAN, VLAN25...)? Don't forget to erase any public IPs in the photos.
-
@spgeise Also, show us what you tried when attempting to activate the PfSense NTP and DNS.
-
NTP was always configured in the pfSense, with all interfaces included. It just refused to function on the VLAN25 interface. Strangely enough, specifying the VLAN25 address wasn't enough. Once I set the port to 123 I started to get some hits.
We'll go with this for now.
-
@spgeise Do you have any floating rules, by any chance?
-
@NightlyShark Nope.
-
@spgeise said in Traffic seems to be ignoring rules:
That's why quad 9s and 4s are allowed out.
Has nothing to do with pool changing..
By allowing access to those DNS servers, they can resolve the pool address
The problem is pfsense needs to resolve them, and default would do that every 5 minutes.. And the TTL on those entries is only 130 seconds
;; ANSWER SECTION: pool.ntp.org. 130 IN A 69.10.223.130 pool.ntp.org. 130 IN A 65.100.46.166 pool.ntp.org. 130 IN A 162.159.200.1 pool.ntp.org. 130 IN A 5.78.89.3If you want your cameras to use quad9 for their dns - sure that is fine.. But for pfsense to allow sometyhing.whatever.tld that you resolve, it has to have resolved that to an IP and put it in an alias.. When those don't match up your device is not going to be allowed.. So if pfsense resolve it to 1.2.3.4 and says ok devices can go to that IP on 123 udp.. But your client resolves and wants to go to 4.5.6.7 its not going to work..
NTP on pfsense should work right out of the box.. There should be nothing you need to do to have it syncing time.. I even think its enabled out of the box... If pfsense ntp is not working?? Or your saying you can not get clients to sync with pfsense ntp? What does pfsense show for its ntp service?
edit: And again your cameras should be able to sync time with your NVR via IPC sync.. And no need to talk to any ntp servers be local or public.
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 25.07.1 | Lab VMs 2.8, 25.07.1 -
@johnpoz Kind of an up-in-the-clouds thing, sorry (you say "don't PM me"), and sorry for the mini hijack, but, what program do you use for screenshots? I'm stuck with the Win11 snipping tool. Sorry...
-
@NightlyShark I use faststone capture - have been using it for years and years. Back when it use to be free, but that changed - best 20 bucks spent on software I think ;)
-
@johnpoz Thank you!
-
@NightlyShark I love it.. Does anything you could ever want, its lightweight - even can do a portable install. And they keep adding features.. There are updates maybe a few times a year.. Well worth the 20 bucks that is for sure.. Pretty sure they have a like free trial for 30 days or something even.
I have been using it prob 20 years or so.. ;) Or getting real close to that long.
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 25.07.1 | Lab VMs 2.8, 25.07.1 -
@johnpoz said in Traffic seems to be ignoring rules:
The problem is pfsense needs to resolve them,
That's a great point. I didn't think about the pfSense rules resolving versus the camera device resolving with its own DNS settings. Makes more sense now. It's still odd that it only worked once I specified port 123. The cameras get DHCP reservations from the interface address so I assumed other ports would work as well.
-
@spgeise said in Traffic seems to be ignoring rules:
The cameras get DHCP reservations from the interface address so I assumed other ports would work as well.
There are hidden rules that allow for dhcp when you enable it on an interface. If you want some client to ask pfsense for ntp, you would have to create a rule that allows that. Works on lan, because there is an any any rule.
-
@johnpoz Will try it first thing tomorrow, my eyes are closing.
-
@NightlyShark also - doesn't matter if they used the same dns... here asking quad9 a few seconds apart in each query - look at what is returned
;; ANSWER SECTION: 0.north-america.pool.ntp.org. 26 IN A 104.156.246.53 0.north-america.pool.ntp.org. 26 IN A 172.232.189.187 0.north-america.pool.ntp.org. 26 IN A 99.119.214.210 0.north-america.pool.ntp.org. 26 IN A 204.17.205.27 ;; Query time: 13 msec ;; SERVER: 9.9.9.9#53(9.9.9.9) ;; WHEN: Sun Mar 17 20:33:23 Central Daylight Time 2024 ;; MSG SIZE rcvd: 121 ;; ANSWER SECTION: 0.north-america.pool.ntp.org. 12 IN A 142.147.88.111 0.north-america.pool.ntp.org. 12 IN A 99.119.214.210 0.north-america.pool.ntp.org. 12 IN A 216.128.181.220 0.north-america.pool.ntp.org. 12 IN A 205.233.73.201 ;; Query time: 10 msec ;; SERVER: 9.9.9.9#53(9.9.9.9) ;; WHEN: Sun Mar 17 20:33:32 Central Daylight Time 2024 ;; MSG SIZE rcvd: 121 ;; ANSWER SECTION: 0.north-america.pool.ntp.org. 109 IN A 50.205.57.38 0.north-america.pool.ntp.org. 109 IN A 152.70.159.102 0.north-america.pool.ntp.org. 109 IN A 216.197.156.83 0.north-america.pool.ntp.org. 109 IN A 129.146.193.200 ;; Query time: 11 msec ;; SERVER: 9.9.9.9#53(9.9.9.9) ;; WHEN: Sun Mar 17 20:34:22 Central Daylight Time 2024 ;; MSG SIZE rcvd: 121I mean it bound to line up some of the time, but also there are prob going to be lots of times it doesn't and won't be able to talk to ntp..
With something like a ntp pool fqdn that has hundreds of IPs in the pool, and dns designed to send out different IPs all the time to spread the load across them.. I currently show like 570 ips in the US ntp pool. https://www.ntppool.org/en/zone/us
And this changes all the time.
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 25.07.1 | Lab VMs 2.8, 25.07.1 -
@johnpoz I know... I saw that they managed to configure PfSense as NTP and let it slide...
-
@spgeise said in Traffic seems to be ignoring rules:
NTP was always configured in the pfSense, with all interfaces included. It just refused to function on the VLAN25 interface. Strangely enough, specifying the VLAN25 address wasn't enough. Once I set the port to 123 I started to get some hits.
We'll go with this for now.
