Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NTP Issue

    Scheduled Pinned Locked Moved General pfSense Questions
    98 Posts 11 Posters 15.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • ARAMP1A
      ARAMP1 @johnpoz
      last edited by

      @johnpoz said in NTP Issue:

      @ARAMP1 the sniff would be just packet capture under the diagnostic menu.. You can have it only capture the ntp from your IP of your ntp server and port 123.

      Select the interface used to talk to your ntp server, assuming that is your lan interface.

      You can then download that capture and we can look at it with say wireshark.

      The info from your nas is good.. what IP is your nas on, I assume its on this same 192.168.10 network.

      My windows machine is on the 10.10.50 network and that truenas machine is on the 192.168.60 network but I have rules on each of those VLANs to access 192.168.10.120 for NTP (the 192.168.10 network is my management network with all my switches, access points, etc).

      For cameras, here's the rules I have in place.

      Cameras Port 123.jpg

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @ARAMP1
        last edited by johnpoz

        @ARAMP1 well that is interesting.. So the devices on different networks sync fine - but the pfsense on the same network is not able to reach it??

        Your not doing anything with ethernet filtering, nor any floating rules for outbound filtering?

        As a test - your truenas can act as ntp server I would assume.. Can you point pfsense to it?

        Example - just pointed pfsense to my nas.

        nasntp.jpg

        notice it shows the 9.10 address of my nas, and it shows its ref as my pi ntp server the 3.32 IP

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        ARAMP1A 1 Reply Last reply Reply Quote 0
        • ARAMP1A
          ARAMP1
          last edited by

          Here's a short run of the packet capture...

          00:56:11.413566 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
          00:56:11.413612 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
          00:56:11.414620 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
          00:56:11.414652 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
          00:57:17.413522 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
          00:57:17.413531 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
          00:57:17.414624 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
          00:57:17.414659 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
          00:58:23.373022 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
          00:58:23.373061 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
          00:58:23.373684 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
          00:58:23.373718 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
          00:58:42.477178 IP 10.10.50.230.44863 > 192.168.10.120.123: UDP, length 48
          00:58:42.477281 IP 10.10.50.230.44863 > 192.168.10.120.123: UDP, length 48
          00:58:42.477576 IP 192.168.10.120.123 > 10.10.50.230.44863: UDP, length 48
          00:58:42.477597 IP 192.168.10.120.123 > 10.10.50.230.44863: UDP, length 48
          00:58:43.586214 IP 10.10.50.230.50913 > 192.168.10.120.123: UDP, length 48
          00:58:43.586317 IP 10.10.50.230.50913 > 192.168.10.120.123: UDP, length 48
          00:58:43.586555 IP 192.168.10.120.123 > 10.10.50.230.50913: UDP, length 48
          00:58:43.586560 IP 192.168.10.120.123 > 10.10.50.230.50913: UDP, length 48
          00:58:45.604892 IP 10.10.50.230.41040 > 192.168.10.120.123: UDP, length 48
          00:58:45.605003 IP 10.10.50.230.41040 > 192.168.10.120.123: UDP, length 48
          00:58:45.605557 IP 192.168.10.120.123 > 10.10.50.230.41040: UDP, length 48
          00:58:45.605580 IP 192.168.10.120.123 > 10.10.50.230.41040: UDP, length 48
          00:58:47.636203 IP 10.10.50.230.54265 > 192.168.10.120.123: UDP, length 48
          00:58:47.636249 IP 10.10.50.230.54265 > 192.168.10.120.123: UDP, length 48
          00:58:47.636552 IP 192.168.10.120.123 > 10.10.50.230.54265: UDP, length 48
          00:58:47.636578 IP 192.168.10.120.123 > 10.10.50.230.54265: UDP, length 48
          00:58:49.778857 IP 10.10.50.230.56448 > 192.168.10.120.123: UDP, length 48
          00:58:49.778967 IP 10.10.50.230.56448 > 192.168.10.120.123: UDP, length 48
          00:58:49.779532 IP 192.168.10.120.123 > 10.10.50.230.56448: UDP, length 48
          00:58:49.779552 IP 192.168.10.120.123 > 10.10.50.230.56448: UDP, length 48
          00:58:51.786147 IP 10.10.50.230.36563 > 192.168.10.120.123: UDP, length 48
          00:58:51.786273 IP 10.10.50.230.36563 > 192.168.10.120.123: UDP, length 48
          00:58:51.786525 IP 192.168.10.120.123 > 10.10.50.230.36563: UDP, length 48
          00:58:51.786529 IP 192.168.10.120.123 > 10.10.50.230.36563: UDP, length 48
          00:58:53.816726 IP 10.10.50.230.58706 > 192.168.10.120.123: UDP, length 48
          00:58:53.816798 IP 10.10.50.230.58706 > 192.168.10.120.123: UDP, length 48
          00:58:53.817676 IP 192.168.10.120.123 > 10.10.50.230.58706: UDP, length 48
          00:58:53.817681 IP 192.168.10.120.123 > 10.10.50.230.58706: UDP, length 48
          00:58:54.780841 IP 10.10.50.230.56213 > 192.168.10.120.123: UDP, length 48
          00:58:54.780910 IP 10.10.50.230.56213 > 192.168.10.120.123: UDP, length 48
          00:58:54.781525 IP 192.168.10.120.123 > 10.10.50.230.56213: UDP, length 48
          00:58:54.781533 IP 192.168.10.120.123 > 10.10.50.230.56213: UDP, length 48
          00:58:56.791962 IP 10.10.50.230.46158 > 192.168.10.120.123: UDP, length 48
          00:58:56.792080 IP 10.10.50.230.46158 > 192.168.10.120.123: UDP, length 48
          00:58:56.792530 IP 192.168.10.120.123 > 10.10.50.230.46158: UDP, length 48
          00:58:56.792551 IP 192.168.10.120.123 > 10.10.50.230.46158: UDP, length 48
          00:58:58.467266 IP 10.10.50.230.54383 > 192.168.10.120.123: UDP, length 48
          00:58:58.467305 IP 10.10.50.230.54383 > 192.168.10.120.123: UDP, length 48
          00:58:58.467569 IP 192.168.10.120.123 > 10.10.50.230.54383: UDP, length 48
          00:58:58.467574 IP 192.168.10.120.123 > 10.10.50.230.54383: UDP, length 48
          00:59:00.508052 IP 10.10.50.230.44608 > 192.168.10.120.123: UDP, length 48
          00:59:00.508113 IP 10.10.50.230.44608 > 192.168.10.120.123: UDP, length 48
          00:59:00.508564 IP 192.168.10.120.123 > 10.10.50.230.44608: UDP, length 48
          00:59:00.508568 IP 192.168.10.120.123 > 10.10.50.230.44608: UDP, length 48
          00:59:02.576259 IP 10.10.50.230.54479 > 192.168.10.120.123: UDP, length 48
          00:59:02.576371 IP 10.10.50.230.54479 > 192.168.10.120.123: UDP, length 48
          00:59:02.576552 IP 192.168.10.120.123 > 10.10.50.230.54479: UDP, length 48
          00:59:02.576558 IP 192.168.10.120.123 > 10.10.50.230.54479: UDP, length 48
          00:59:04.587321 IP 10.10.50.230.34257 > 192.168.10.120.123: UDP, length 48
          00:59:04.587386 IP 10.10.50.230.34257 > 192.168.10.120.123: UDP, length 48
          00:59:04.587550 IP 192.168.10.120.123 > 10.10.50.230.34257: UDP, length 48
          00:59:04.587556 IP 192.168.10.120.123 > 10.10.50.230.34257: UDP, length 48
          00:59:06.612532 IP 10.10.50.230.37136 > 192.168.10.120.123: UDP, length 48
          00:59:06.612592 IP 10.10.50.230.37136 > 192.168.10.120.123: UDP, length 48
          00:59:06.613552 IP 192.168.10.120.123 > 10.10.50.230.37136: UDP, length 48
          00:59:06.613578 IP 192.168.10.120.123 > 10.10.50.230.37136: UDP, length 48
          00:59:08.641801 IP 10.10.50.230.33174 > 192.168.10.120.123: UDP, length 48
          00:59:08.641915 IP 10.10.50.230.33174 > 192.168.10.120.123: UDP, length 48
          00:59:08.642548 IP 192.168.10.120.123 > 10.10.50.230.33174: UDP, length 48
          00:59:08.642570 IP 192.168.10.120.123 > 10.10.50.230.33174: UDP, length 48
          00:59:29.381935 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
          00:59:29.381971 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
          00:59:29.382608 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
          00:59:29.382641 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
          01:00:13.721904 IP 10.10.50.230.48115 > 192.168.10.120.123: UDP, length 48
          01:00:13.722019 IP 10.10.50.230.48115 > 192.168.10.120.123: UDP, length 48
          01:00:13.722520 IP 192.168.10.120.123 > 10.10.50.230.48115: UDP, length 48
          01:00:13.722524 IP 192.168.10.120.123 > 10.10.50.230.48115: UDP, length 48
          01:00:38.413534 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
          01:00:38.413568 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
          01:00:38.414569 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
          01:00:38.414598 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
          01:00:52.473322 IP 192.168.10.1.123 > 192.168.10.120.123: UDP, length 48
          01:00:52.473549 IP 192.168.10.120.123 > 192.168.10.1.123: UDP, length 48
          01:00:55.450351 IP 192.168.10.1.123 > 192.168.10.120.123: UDP, length 48
          01:00:55.450552 IP 192.168.10.120.123 > 192.168.10.1.123: UDP, length 48
          01:01:00.525365 IP 192.168.10.1.123 > 192.168.10.120.123: UDP, length 48
          01:01:00.525543 IP 192.168.10.120.123 > 192.168.10.1.123: UDP, length 48
          01:01:18.317945 IP 10.10.50.230.38268 > 192.168.10.120.123: UDP, length 48
          01:01:18.318057 IP 10.10.50.230.38268 > 192.168.10.120.123: UDP, length 48
          01:01:18.318613 IP 192.168.10.120.123 > 10.10.50.230.38268: UDP, length 48
          01:01:18.318635 IP 192.168.10.120.123 > 10.10.50.230.38268: UDP, length 48
          01:01:47.398970 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
          01:01:47.399009 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
          01:01:47.399617 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
          01:01:47.399650 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
          01:02:05.525345 IP 192.168.10.1.123 > 192.168.10.120.123: UDP, length 48
          01:02:05.525544 IP 192.168.10.120.123 > 192.168.10.1.123: UDP, length 48
          01:02:22.690101 IP 10.10.50.230.44520 > 192.168.10.120.123: UDP, length 48
          01:02:22.690213 IP 10.10.50.230.44520 > 192.168.10.120.123: UDP, length 48
          01:02:22.690525 IP 192.168.10.120.123 > 10.10.50.230.44520: UDP, length 48
          01:02:22.690546 IP 192.168.10.120.123 > 10.10.50.230.44520: UDP, length 48
          01:02:54.378938 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
          01:02:54.378974 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
          01:02:54.379592 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
          01:02:54.379623 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
          01:03:09.525230 IP 192.168.10.1.123 > 192.168.10.120.123: UDP, length 48
          01:03:09.525545 IP 192.168.10.120.123 > 192.168.10.1.123: UDP, length 48
          01:03:27.350112 IP 10.10.50.230.52709 > 192.168.10.120.123: UDP, length 48
          01:03:27.350221 IP 10.10.50.230.52709 > 192.168.10.120.123: UDP, length 48
          01:03:27.350617 IP 192.168.10.120.123 > 10.10.50.230.52709: UDP, length 48
          01:03:27.350637 IP 192.168.10.120.123 > 10.10.50.230.52709: UDP, length 48

          johnpozJ 1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @ARAMP1
            last edited by

            @ARAMP1 said in NTP Issue:

            01:02:05.525345 IP 192.168.10.1.123 > 192.168.10.120.123: UDP, length 48
            01:02:05.525544 IP 192.168.10.120.123 > 192.168.10.1.123: UDP, length 48

            I take it that is your pfsense IP at 10.1 - can you download that and attach the pcap.. For example - here is pcap I did earlier

            packetcapture-igb3-20240602095409.pcap

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • ARAMP1A
              ARAMP1 @johnpoz
              last edited by

              @johnpoz said in NTP Issue:

              @ARAMP1 well that is interesting.. So the devices on different networks sync fine - but the pfsense on the same network is not able to reach it??

              Your not doing anything with ethernet filtering, nor any floating rules for outbound filtering?

              As a test - your truenas can act as ntp server I would assume.. Can you point pfsense to it?

              Example - just pointed pfsense to my nas.

              nasntp.jpg

              notice it shows the 9.10 address of my nas, and it shows its ref as my pi ntp server the 3.32 IP

              Just tried pointing it to a couple truenas servers I have on different VLANs. Both are Unreach/Pending.

              The floating rules I have in place only have to do with CoDel traffic limiter and pfBlocker.

              ARAMP1A 1 Reply Last reply Reply Quote 0
              • ARAMP1A
                ARAMP1 @ARAMP1
                last edited by

                packetcapture-ix1-20240602201708.pcap

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @ARAMP1
                  last edited by

                  @ARAMP1 this seems a bit odd

                  odd.jpg

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  ARAMP1A 2 Replies Last reply Reply Quote 0
                  • ARAMP1A
                    ARAMP1 @johnpoz
                    last edited by

                    @johnpoz I'm looking at wireshark now, but I don't know what I'm looking at.

                    1 Reply Last reply Reply Quote 0
                    • ARAMP1A
                      ARAMP1 @johnpoz
                      last edited by

                      @johnpoz said in NTP Issue:

                      @ARAMP1 this seems a bit odd

                      odd.jpg

                      Something with the DNS server? Here's my setup.

                      DNS server.jpg

                      johnpozJ 2 Replies Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @ARAMP1
                        last edited by

                        @ARAMP1 no it wouldn't have anything to do with dns, because your pointing to an IP for the server.

                        I would think that ref ID would point to the IP your asking.. see in mine it shows my 192.168.3.32?

                        It might be like that because it has never gotten an answer? So it has no ref as of yet?

                        From your sniff you get an answer, so why would ntp think it can not reach that server?

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @ARAMP1
                          last edited by

                          @ARAMP1 can you turn off ntp and validate nothing is listening on 123..

                          example

                          grep.jpg

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          ARAMP1A 1 Reply Last reply Reply Quote 0
                          • ARAMP1A
                            ARAMP1 @johnpoz
                            last edited by ARAMP1

                            packetcapture-ix1-20240602204723.pcap

                            I've still pointed clients at 192.168.10.120 directly, so that would still show something listening on port 123, right?

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @ARAMP1
                              last edited by

                              @ARAMP1 not clicked to not enable it

                              As you see when I disable it nothing is listening on 123

                              Also can you one you enable it again, post up your ntpd.conf

                              [23.09.1-RELEASE][admin@sg4860.home.arpa]/: cat /var/etc/ntpd.conf 
# 
# pfSense ntp configuration file 
# 

tinker panic 0 

# Orphan mode stratum and Maximum candidate NTP peers
tos orphan 12 maxclock 5


# Upstream Servers
server -4 192.168.3.32 iburst minpoll 6 maxpoll 10 prefer


enable stats
statistics clockstats loopstats peerstats
statsdir /var/log/ntp
logconfig =syncall +clockall +peerall +sysall
driftfile /var/db/ntpd.drift
restrict default kod limited nomodify nopeer notrap
restrict -6 default kod limited nomodify nopeer notrap
interface ignore all
interface ignore wildcard
interface listen igb2.1011
interface listen igb3
interface listen igb0
interface listen igb4
interface listen igb2
interface listen igb2.110
interface listen igb2.6
interface listen igb2.4
interface listen igb5
interface listen lo0
[23.09.1-RELEASE][admin@sg4860.home.arpa]/:

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              ARAMP1A 1 Reply Last reply Reply Quote 0
                              • ARAMP1A
                                ARAMP1 @johnpoz
                                last edited by

                                @johnpoz said in NTP Issue:

                                cat /var/etc/ntpd.conf

                                cmd prompt.jpg

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @ARAMP1
                                  last edited by

                                  @ARAMP1 ok the only thing that looks odd is your restrict 192.168.10.120 that is not really a network that is a host address. The network with /24 would be 192.168.10.0

                                  After seeing yours noticed mine wasn't even listed... I removed mine completely because to be honest that is for clients wanting to talk to pfsense as their server. So you shouldn't even need that.

                                  I would remove it, but that would be really crazy if that was the issue.

                                  Nothing is there that makes any sense to why it wouldn't be working that I am seeing..

                                  So you have no native network on the ix1 interface.. Only vlans.. I take it ix1.10 is your 192.168.10 interface..

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  ARAMP1A 1 Reply Last reply Reply Quote 1
                                  • ARAMP1A
                                    ARAMP1 @johnpoz
                                    last edited by

                                    @johnpoz I'm not following when you say "I would remove it". What would/did you remove?

                                    I have a native network on the ix1 interface but it's not enabled.

                                    INterfaces 3.jpg

                                    GertjanG 1 Reply Last reply Reply Quote 0
                                    • GertjanG
                                      Gertjan @ARAMP1
                                      last edited by

                                      @ARAMP1 said in NTP Issue:

                                      I'm not following when you say "I would remove it". What would/did you remove?

                                      Here :

                                      4e3e26db-fdfc-4902-abcf-6a64f15ce8c3-image.png

                                      No "help me" PM's please. Use the forum, the community will thank you.
                                      Edit : and where are the logs ??

                                      1 Reply Last reply Reply Quote 1
                                      • JonathanLeeJ
                                        JonathanLee
                                        last edited by

                                        One other small note:

                                        Anyone remember that authentication ticket that has been open for years with NTP, someone named Mathew fixed it and has a pull in the system no one has reviewed it yet, it fixed the GUI issue and also some other items with the pool for NTP.

                                        @MatthewA1 @LamaZ

                                        https://github.com/pfsense/pfsense/pull/4658.diff

                                        Did this github ever get merged?

                                        847e417b5612f28bc1e84ca028a980df9c5c57a7

                                        I can pull it in patches now

                                        Make sure to upvote

                                        M 1 Reply Last reply Reply Quote 1
                                        • M
                                          MatthewA1 @JonathanLee
                                          last edited by

                                          @JonathanLee Officially been 6 months since the last feedback I've gotten... PR is still open with the "Changes Requested" label applied even though I made the requested changes

                                          JonathanLeeJ 1 Reply Last reply Reply Quote 0
                                          • JonathanLeeJ
                                            JonathanLee @MatthewA1
                                            last edited by

                                            @MatthewA1 push it to the new development version see what happens, I think that older thread is not being looked at any longer

                                            Make sure to upvote

                                            1 Reply Last reply Reply Quote 1
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.