Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NTP Issue

    Scheduled Pinned Locked Moved General pfSense Questions
    72 Posts 11 Posters 6.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • kiokomanK
      kiokoman LAYER 8 @ARAMP1
      last edited by kiokoman

      @ARAMP1
      I think it's just a label or the way I configured my ntpsec, either way this shows that pfsense is able to communicate with your ntp server on port 123

      the only way for me to have a Unreach/Pending state is when i select an isolated interface that is unable to reach my ntp server.
      did you try to change the interface where it's listening? like localhost only ?

      ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
      Please do not use chat/PM to ask for help
      we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
      Don't forget to Upvote with the 👍 button for any post you find to be helpful.

      ARAMP1A 1 Reply Last reply Reply Quote 1
      • ARAMP1A
        ARAMP1 @kiokoman
        last edited by ARAMP1

        @kiokoman said in NTP Issue:

        did you try to change the interface where it's listening? like localhost only ?

        Just tried that...no change.

        1 Reply Last reply Reply Quote 0
        • ARAMP1A
          ARAMP1 @conover
          last edited by

          @conover said in NTP Issue:

          @ARAMP1 sounds like the same issue I have with the plus version 23.09:

          https://forum.netgate.com/post/1136805

          NTP works again going back to previous version (23.05.01)

          I just read through your thread again. I noticed that you were able to point specific machines to the IP address of your NTP server and bypass pfSense. I really want/need a windows machine that I run Blue Iris on and all of my security cameras to be synced, so I did that for that windows machine and it works fine.

          1 Reply Last reply Reply Quote 0
          • JonathanLeeJ
            JonathanLee
            last edited by JonathanLee

            They have a Redmine open for NTP authentication issues I think the patch that Marcos and Matthew merged might also fix this. The GitHub was merged a couple days ago but has not been looked at but it looked to incorporate many fixes not just authentication issues.

            https://redmine.pfsense.org/issues/8794

            https://github.com/pfsense/pfsense/commit/847e417b5612f28bc1e84ca028a980df9c5c57a7

            Make sure to upvote

            ARAMP1A 1 Reply Last reply Reply Quote 1
            • A
              admacdo @ARAMP1
              last edited by

              @ARAMP1
              Well, it's taken me quite a few hours to get to this post.
              I went to check my time precision this morning and noticed that the graphs were all way out.
              Checking when it started, it was right after I upgraded to 2.7.2.
              Looking at my local Stratum 1 NTP server, it's pending/unreachable and the firewall has fallen back to time.apple.com

              With the basics checked, then ACL's adjusted and even firewall rules put in, the ntpupdate -4 command showed that everything is working as it should. (And likely was before I did anything other than upgrade...)
              pfsense just refuses to accept any NTP traffic from the LAN side of the house.
              Right when I was starting to think it couldn't be much else than a system issue, I found this thread.
              As well as confirming that some of us take time seriously, it was nice to know that we've got the same issue.

              Looks like a roll back is in order, or just wait for the patch

              ARAMP1A 1 Reply Last reply Reply Quote 3
              • ARAMP1A
                ARAMP1 @admacdo
                last edited by

                @admacdo said in NTP Issue:

                Looks like a roll back is in order, or just wait for the patch

                Even though there are issues with this (and also the ARP table showing permanent entries), I've decided to keep it at 2.7.2. I still show a stratum 1 using the nist.gov clocks. The only issue would be if the internet goes down. If it becomes an issue with individual machines, I'll direct them to my local NTP server then.

                E 1 Reply Last reply Reply Quote 0
                • E
                  EricMc1 @ARAMP1
                  last edited by

                  just to pile on one more, I have the same issue on 23.09.1 on two 6100s with a local TM2000 on the same lan. I tried all of the things mentioned in these threads with no changes. It looks like it broke on 23.09 for me as well (after reviewing the RRD after I noticed the issue).

                  1 Reply Last reply Reply Quote 2
                  • ARAMP1A
                    ARAMP1 @JonathanLee
                    last edited by

                    @JonathanLee said in NTP Issue:

                    They have a Redmine open for NTP authentication issues I think the patch that Marcos and Matthew merged might also fix this.

                    I just played around a bit with this and couldn't get it to work.

                    C johnpozJ 2 Replies Last reply Reply Quote 0
                    • C
                      conover @ARAMP1
                      last edited by

                      @ARAMP1 said in NTP Issue:

                      @JonathanLee said in NTP Issue:

                      They have a Redmine open for NTP authentication issues I think the patch that Marcos and Matthew merged might also fix this.

                      I just played around a bit with this and couldn't get it to work.

                      it is not fixed, also not able to get it to work in 24.03

                      1 Reply Last reply Reply Quote 0
                      • JonathanLeeJ
                        JonathanLee
                        last edited by JonathanLee

                        Seems the newer versions of software function by way of a different pair of spectacles. I have a number of issues versus older reliable versions. I can tell you I personally like the old software better, it functions and feels far more resilient. I wonder why, I really do. I shouldn’t feel less trust with the new software. Again I hate to admit it’s starting to feel like that. Leading to, I shouldn’t feel afraid to upgrade. I use to get excited about even upgrade, now I question what is going to be broken if I upgrade. I am fearful of updates. Weird right? Is it big tech influence? Who knows, maybe I am just paranoid and don’t want to risk it now that I have it working way I want. Sorry it isn’t working

                        Make sure to upvote

                        C 1 Reply Last reply Reply Quote 2
                        • C
                          conover @JonathanLee
                          last edited by

                          @JonathanLee said in NTP Issue:

                          Seems the newer versions of software function by way of a different pair of spectacles. I have a number of issues versus older reliable versions. I can tell you I personally like the old software better, it functions and feels far more resilient. I wonder why, I really do. I shouldn’t feel less trust with the new software. Again I hate to admit it’s starting to feel like that. Leading to, I shouldn’t feel afraid to upgrade. I use to get excited about even upgrade, now I question what is going to be broken if I upgrade. I am fearful of updates. Weird right? Is it big tech influence? Who knows, maybe I am just paranoid and don’t want to risk it now that I have it working way I want. Sorry it isn’t working

                          Fully agreed!
                          That's the reason why I did not upgraded all my boxes yet.
                          Firewall software with a bad gut feeling is a "no go" (for me).
                          So I am started to thinking about changing the system with the next (hardware) cycle....

                          Dobby_D 1 Reply Last reply Reply Quote 1
                          • Dobby_D
                            Dobby_ @conover
                            last edited by

                            @conover said in NTP Issue:

                            So I am started to thinking about changing the system with the next (hardware) cycle....

                            What you are thinking to go with?
                            OPNSense, OpenWRT, RouterOS, VyOS, ClearOS, Untangle,......

                            #~. @Dobby

                            Turris Omnia - 4 Ports - 2 GB RAM / TurrisOS 7 Release (Btrfs)
                            PC Engines APU4D4 - 4 Ports - 4 GB RAM / pfSense CE 2.7.2 Release (ZFS)
                            PC Engines APU6B4 - 4 Ports - 4 GB RAM / pfSense+ (Plus) 24.03_1 Release (ZFS)

                            C 1 Reply Last reply Reply Quote 0
                            • C
                              conover @Dobby_
                              last edited by

                              @Dobby_ said in NTP Issue:

                              @conover said in NTP Issue:

                              So I am started to thinking about changing the system with the next (hardware) cycle....

                              What you are thinking to go with?
                              OPNSense, OpenWRT, RouterOS, VyOS, ClearOS, Untangle,......

                              To be honest, not sure yet. Just started thinking about it....

                              Dobby_D 1 Reply Last reply Reply Quote 0
                              • Dobby_D
                                Dobby_ @conover
                                last edited by

                                @conover said in NTP Issue:

                                To be honest, not sure yet. Just started thinking about it....

                                I ordered some parts for setting up a tiny LAN server to free pfSense from
                                some tasks or services. Its nearly 200ish € but its worth in my eyes.

                                RaspBerry PI 4 B (8GB)
                                GPS hat (u.blox M8)
                                Micro SD card 64 GB
                                mSATA board x857
                                active magnetic GSP antenna (5 meter cable)
                                USB C - PSU

                                Later it should run the following services;

                                • PI hole or CrowdSec
                                • syslog-ng server
                                • NTP (Internet, RTC, GPS)
                                • RadiusServer (FreeRadius)
                                • LDAP server (OpenLDAP)

                                Eventually later a DCF77 kit over USB but this is actually only brainstorming.
                                So for the entire network it will be then a Stratum1 NTP server with RTC,
                                GPS and over the internet with 4 pools and 4 servers.

                                #~. @Dobby

                                Turris Omnia - 4 Ports - 2 GB RAM / TurrisOS 7 Release (Btrfs)
                                PC Engines APU4D4 - 4 Ports - 4 GB RAM / pfSense CE 2.7.2 Release (ZFS)
                                PC Engines APU6B4 - 4 Ports - 4 GB RAM / pfSense+ (Plus) 24.03_1 Release (ZFS)

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @ARAMP1
                                  last edited by johnpoz

                                  @ARAMP1 said in NTP Issue:

                                  I just played around a bit with this and couldn't get it to work.

                                  And what did you play with? Can we see your config? Can we see your ntp log? Can we see a simple sniff, you say it works via just using ntp out on the internet. Can we see sniff of that working?

                                  I have been running a pi as my ntp server via a gps hat and yeah it would use pps as the source. For years, multiple versions of pfsense back to pre + days, And currently have a 2.7.2 pfsense as well as 23.09.1 and not having any issues syncing with my pi ntp server.

                                  Are you trying to use auth? To your ntp - you say none of your other devices have any issues syncing with your ntp server? Can we see this output?

                                  example

                                  $ ntpq
                                  ntpq> pe
                                       remote           refid      st t when poll reach   delay   offset  jitter
                                  ==============================================================================
                                  *ntp.home.arpa   .PPS.            1 u   57  128  377    1.542   +0.376   0.193
                                  ntpq>
                                  

                                  My windows box sync with my pi, here is pfsense

                                  [23.09.1-RELEASE][admin@sg4860.home.arpa]/root: ntpq
                                  ntpq> pe
                                       remote           refid      st t when poll reach   delay   offset  jitter
                                  ==============================================================================
                                  *ntp.home.arpa   .PPS.            1 u  137  512  377    0.449   -0.741   0.189
                                  ntpq> 
                                  

                                  What are you using as your ntp server, ntpsec, chrony, just the plain jane ntp from ntp.org?

                                  If there was some inherent bug/issue with ntp sync then you would think there would be many posts about it.. Since there does not seem to be - this points to something unique in your setup that is problematic, etc..

                                  here is my settings, where 192.168.3.32 is my pi ntp box.. Which is running ntpsec

                                  ntp.jpg

                                  Here is my pi output

                                  pi@pi-ntp:~ $ ntpq
                                  ntpq> pe
                                       remote                                   refid      st t when poll reach   delay   offset   jitter
                                  =======================================================================================================
                                  *SHM(1)                                  .PPS.            0 l    2   16  377   0.0000  -0.6487   0.0136
                                  -SHM(0)                                  .GPS.            0 l   42   64  377   0.0000 -150.638   1.3091
                                  +ntp-0.gw.illinois.edu                   200.7.224.32     2 u    6   64  377  12.1672   2.2484   1.0747
                                  +ntp.your.org                            .GPS.            1 u   41   64  377  10.5027   2.4140   0.7471
                                  -tock.usshc.com                          .WAAS.           1 u   37   64  377  16.0153   1.7570   0.6719
                                  -ntp1.netwrx1.com                        24.196.111.36    2 u   33   64  377  37.7684  -2.0801   1.9852
                                  ntpq> version
                                  ntpsec-1.2.1+85-g1a7bb2e3a
                                  ntpq>
                                  

                                  edit: my 2.7.2 box was off, just booted it - and can see right away that it can talk to my ntp server.. as reach is counting up

                                  272.jpg

                                  edit2: just booted my 24.03 and pointed it to my ntp server and bam its talking to it as you can see reach is counting up as well

                                  2403.jpg

                                  here is a pcap of pfsense 3.253 talking to the ntp server 3.32

                                  pcap.jpg

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  ARAMP1A 1 Reply Last reply Reply Quote 1
                                  • C
                                    conover
                                    last edited by

                                    @johnpoz said in NTP Issue:

                                    If there was some inherent bug/issue with ntp sync then you would think there would be many posts about it.. Since there does not seem to be - this points to something unique in your setup that is problematic, etc..

                                    well, there are 3 or 4 post addressing that issue and a few people hopped on each thread.

                                    The problem is, that NTP works but not with all NTP servers. The latter one is the issue. So it is not an issue with NTP itself.
                                    We went thru all config options and other options (e.g. delete config and start over again etc) in the named threads.

                                    The main point is, NTP worked with the mentioned specifc server type (which are also working with all other clients) in 23.05 / 23.05.01 and stopped working in 23.09 (NTP works again going back to 23.05). And still not works with 24.03.

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @conover
                                      last edited by

                                      @conover said in NTP Issue:

                                      well, there are 3 or 4 post addressing that issue and a few people hopped on each thread.

                                      Lets see out of how many 1000's and 10s of 1000's of pfsense deployments? I am on here way too much, and I am not seeing these posts..

                                      There may well be a bug/issue - but without some actual specifics of the users setup to find something common, users chiming in with me too.. Are of zero help.. For all we know they have some simple misconfiguration.. Like wrong IP address of their ntp server for gosh sake..

                                      the only way to track down what your problem is with info.. Not I play with some stuff and couldn't get it to work ;)

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      C 1 Reply Last reply Reply Quote 0
                                      • C
                                        conover @johnpoz
                                        last edited by

                                        @johnpoz guess, all infos can be found here: https://forum.netgate.com/topic/184170/23-09-local-ntp-server-unrechable-worked-with-23-05-1

                                        another thread (besides this one) is here (in German) https://forum.netgate.com/post/1137308

                                        1 Reply Last reply Reply Quote 0
                                        • ARAMP1A
                                          ARAMP1 @johnpoz
                                          last edited by

                                          @johnpoz said in NTP Issue:

                                          @ARAMP1 said in NTP Issue:

                                          I just played around a bit with this and couldn't get it to work.

                                          And what did you play with? Can we see your config? Can we see your ntp log? Can we see a simple sniff, you say it works via just using ntp out on the internet. Can we see sniff of that working?

                                          I have been running a pi as my ntp server via a gps hat and yeah it would use pps as the source. For years, multiple versions of pfsense back to pre + days, And currently have a 2.7.2 pfsense as well as 23.09.1 and not having any issues syncing with my pi ntp server.

                                          Are you trying to use auth? To your ntp - you say none of your other devices have any issues syncing with your ntp server? Can we see this output?

                                          example

                                          $ ntpq
                                          ntpq> pe
                                               remote           refid      st t when poll reach   delay   offset  jitter
                                          ==============================================================================
                                          *ntp.home.arpa   .PPS.            1 u   57  128  377    1.542   +0.376   0.193
                                          ntpq>
                                          

                                          My windows box sync with my pi, here is pfsense

                                          [23.09.1-RELEASE][admin@sg4860.home.arpa]/root: ntpq
                                          ntpq> pe
                                               remote           refid      st t when poll reach   delay   offset  jitter
                                          ==============================================================================
                                          *ntp.home.arpa   .PPS.            1 u  137  512  377    0.449   -0.741   0.189
                                          ntpq> 
                                          

                                          What are you using as your ntp server, ntpsec, chrony, just the plain jane ntp from ntp.org?

                                          If there was some inherent bug/issue with ntp sync then you would think there would be many posts about it.. Since there does not seem to be - this points to something unique in your setup that is problematic, etc..

                                          here is my settings, where 192.168.3.32 is my pi ntp box.. Which is running ntpsec

                                          ntp.jpg

                                          Here is my pi output

                                          pi@pi-ntp:~ $ ntpq
                                          ntpq> pe
                                               remote                                   refid      st t when poll reach   delay   offset   jitter
                                          =======================================================================================================
                                          *SHM(1)                                  .PPS.            0 l    2   16  377   0.0000  -0.6487   0.0136
                                          -SHM(0)                                  .GPS.            0 l   42   64  377   0.0000 -150.638   1.3091
                                          +ntp-0.gw.illinois.edu                   200.7.224.32     2 u    6   64  377  12.1672   2.2484   1.0747
                                          +ntp.your.org                            .GPS.            1 u   41   64  377  10.5027   2.4140   0.7471
                                          -tock.usshc.com                          .WAAS.           1 u   37   64  377  16.0153   1.7570   0.6719
                                          -ntp1.netwrx1.com                        24.196.111.36    2 u   33   64  377  37.7684  -2.0801   1.9852
                                          ntpq> version
                                          ntpsec-1.2.1+85-g1a7bb2e3a
                                          ntpq>
                                          

                                          edit: my 2.7.2 box was off, just booted it - and can see right away that it can talk to my ntp server.. as reach is counting up

                                          272.jpg

                                          edit2: just booted my 24.03 and pointed it to my ntp server and bam its talking to it as you can see reach is counting up as well

                                          2403.jpg

                                          here is a pcap of pfsense 3.253 talking to the ntp server 3.32

                                          pcap.jpg

                                          Oh, I'd bet it's 100% user error, just want to figure out where.

                                          It appears I have it set up like yours.

                                          NTP 3.jpg NTP 2.jpg NTP 1.jpg

                                          I'm using one of those chinese ebay boxes. I've had it running fine in pfSense for about 3 years now.

                                          Here are the logs related to the server at 192.168.10.120

                                          Jun 2 12:45:34 ntpd 8952 192.168.10.120 local addr 192.168.10.1 -> <null>
                                          Jun 2 12:06:10 ntpd 15912 192.168.10.120 local addr 192.168.10.1 -> <null>
                                          Jun 2 12:04:11 ntpd 15912 192.168.10.120 8011 81 mobilize assoc 17918
                                          Jun 2 12:45:34 ntpd 75278 192.168.10.120 8011 81 mobilize assoc 23975
                                          Jun 2 12:06:21 ntpd 8952 192.168.10.120 8011 81 mobilize assoc 59753
                                          Jun 2 12:06:10 ntpd 15912 192.168.10.120 8012 82 demobilize assoc 17918
                                          Jun 2 12:45:34 ntpd 8952 192.168.10.120 8012 82 demobilize assoc 59753

                                          johnpozJ 1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @ARAMP1
                                            last edited by johnpoz

                                            @ARAMP1 one thing I see as different is why are you pointing to multiple pools that are really the same? You run your own ntp server, while sure it should point to some others vs just its gps time.. pfsense really has litte need other than just pointing to your one ntp server that you are running.

                                            Why can it not talk to any of those other ntp servers either.. All of those other ones should be available via wan, that it is seems it talking to the 128.138.141.172 box.

                                            You cut off your config - are you trying to do auth?

                                            If you want to add more later - sure but for troubleshooting I would just point to your 1 local server.. And then sniff do you see an answer?

                                            Can we see your other devices that are syncing off this local server? For example I already showed my windows box syncing - here is one of my switches using it

                                            sg300-28#sho sntp status
                                            
                                            Clock is synchronized, stratum 1, reference is 192.168.3.32, unicast
                                            
                                            Unicast servers:
                                            
                                            Server            : 192.168.3.32
                                              Source          : Static
                                              Stratum         : 1
                                              Status          : up
                                              Last Response   : 17:03:25.0 web Jun 2 2024
                                              Offset          : 347.3516068 mSec
                                              Delay           : -1000 mSec
                                            

                                            here is my nas, and printer all pointing to my local ntp - showing working

                                            printer.jpg

                                            nas.jpg

                                            For troubleshooting - I would set the only interface on to be the one interface where your ntp server is. And I would sniff the traffic to validate you see it sending to it, and getting a response on its own accord, not with the ntpdate command, etc.

                                            Here is my unifi controller setting, and showing that one of the AP is sync'd etc

                                            unifi.jpg

                                            edit: oh my nas is using old name, which still resolves - but should change that to home.arpa vs local.lan

                                            What are you running for your ntp server? ntp, ntpsec, chrony?

                                            edit2: that you are only able to talk to 1 of the many many ntp servers your pointing to is very odd to me.. If there was something wrong with pfsense, why is talking to anything. If there was some disconnect between pfsense and your ntp server, why is it not talking to all the other servers your pointing to?

                                            Clearly something is amiss - figuring out what it is the puzzle needed to be solved.

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            ARAMP1A 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.