Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NTP Issue

    Scheduled Pinned Locked Moved General pfSense Questions
    98 Posts 11 Posters 11.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @ARAMP1
      last edited by johnpoz

      @ARAMP1 well that is interesting.. So the devices on different networks sync fine - but the pfsense on the same network is not able to reach it??

      Your not doing anything with ethernet filtering, nor any floating rules for outbound filtering?

      As a test - your truenas can act as ntp server I would assume.. Can you point pfsense to it?

      Example - just pointed pfsense to my nas.

      nasntp.jpg

      notice it shows the 9.10 address of my nas, and it shows its ref as my pi ntp server the 3.32 IP

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      ARAMP1A 1 Reply Last reply Reply Quote 0
      • ARAMP1A
        ARAMP1
        last edited by

        Here's a short run of the packet capture...

        00:56:11.413566 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
        00:56:11.413612 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
        00:56:11.414620 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
        00:56:11.414652 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
        00:57:17.413522 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
        00:57:17.413531 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
        00:57:17.414624 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
        00:57:17.414659 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
        00:58:23.373022 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
        00:58:23.373061 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
        00:58:23.373684 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
        00:58:23.373718 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
        00:58:42.477178 IP 10.10.50.230.44863 > 192.168.10.120.123: UDP, length 48
        00:58:42.477281 IP 10.10.50.230.44863 > 192.168.10.120.123: UDP, length 48
        00:58:42.477576 IP 192.168.10.120.123 > 10.10.50.230.44863: UDP, length 48
        00:58:42.477597 IP 192.168.10.120.123 > 10.10.50.230.44863: UDP, length 48
        00:58:43.586214 IP 10.10.50.230.50913 > 192.168.10.120.123: UDP, length 48
        00:58:43.586317 IP 10.10.50.230.50913 > 192.168.10.120.123: UDP, length 48
        00:58:43.586555 IP 192.168.10.120.123 > 10.10.50.230.50913: UDP, length 48
        00:58:43.586560 IP 192.168.10.120.123 > 10.10.50.230.50913: UDP, length 48
        00:58:45.604892 IP 10.10.50.230.41040 > 192.168.10.120.123: UDP, length 48
        00:58:45.605003 IP 10.10.50.230.41040 > 192.168.10.120.123: UDP, length 48
        00:58:45.605557 IP 192.168.10.120.123 > 10.10.50.230.41040: UDP, length 48
        00:58:45.605580 IP 192.168.10.120.123 > 10.10.50.230.41040: UDP, length 48
        00:58:47.636203 IP 10.10.50.230.54265 > 192.168.10.120.123: UDP, length 48
        00:58:47.636249 IP 10.10.50.230.54265 > 192.168.10.120.123: UDP, length 48
        00:58:47.636552 IP 192.168.10.120.123 > 10.10.50.230.54265: UDP, length 48
        00:58:47.636578 IP 192.168.10.120.123 > 10.10.50.230.54265: UDP, length 48
        00:58:49.778857 IP 10.10.50.230.56448 > 192.168.10.120.123: UDP, length 48
        00:58:49.778967 IP 10.10.50.230.56448 > 192.168.10.120.123: UDP, length 48
        00:58:49.779532 IP 192.168.10.120.123 > 10.10.50.230.56448: UDP, length 48
        00:58:49.779552 IP 192.168.10.120.123 > 10.10.50.230.56448: UDP, length 48
        00:58:51.786147 IP 10.10.50.230.36563 > 192.168.10.120.123: UDP, length 48
        00:58:51.786273 IP 10.10.50.230.36563 > 192.168.10.120.123: UDP, length 48
        00:58:51.786525 IP 192.168.10.120.123 > 10.10.50.230.36563: UDP, length 48
        00:58:51.786529 IP 192.168.10.120.123 > 10.10.50.230.36563: UDP, length 48
        00:58:53.816726 IP 10.10.50.230.58706 > 192.168.10.120.123: UDP, length 48
        00:58:53.816798 IP 10.10.50.230.58706 > 192.168.10.120.123: UDP, length 48
        00:58:53.817676 IP 192.168.10.120.123 > 10.10.50.230.58706: UDP, length 48
        00:58:53.817681 IP 192.168.10.120.123 > 10.10.50.230.58706: UDP, length 48
        00:58:54.780841 IP 10.10.50.230.56213 > 192.168.10.120.123: UDP, length 48
        00:58:54.780910 IP 10.10.50.230.56213 > 192.168.10.120.123: UDP, length 48
        00:58:54.781525 IP 192.168.10.120.123 > 10.10.50.230.56213: UDP, length 48
        00:58:54.781533 IP 192.168.10.120.123 > 10.10.50.230.56213: UDP, length 48
        00:58:56.791962 IP 10.10.50.230.46158 > 192.168.10.120.123: UDP, length 48
        00:58:56.792080 IP 10.10.50.230.46158 > 192.168.10.120.123: UDP, length 48
        00:58:56.792530 IP 192.168.10.120.123 > 10.10.50.230.46158: UDP, length 48
        00:58:56.792551 IP 192.168.10.120.123 > 10.10.50.230.46158: UDP, length 48
        00:58:58.467266 IP 10.10.50.230.54383 > 192.168.10.120.123: UDP, length 48
        00:58:58.467305 IP 10.10.50.230.54383 > 192.168.10.120.123: UDP, length 48
        00:58:58.467569 IP 192.168.10.120.123 > 10.10.50.230.54383: UDP, length 48
        00:58:58.467574 IP 192.168.10.120.123 > 10.10.50.230.54383: UDP, length 48
        00:59:00.508052 IP 10.10.50.230.44608 > 192.168.10.120.123: UDP, length 48
        00:59:00.508113 IP 10.10.50.230.44608 > 192.168.10.120.123: UDP, length 48
        00:59:00.508564 IP 192.168.10.120.123 > 10.10.50.230.44608: UDP, length 48
        00:59:00.508568 IP 192.168.10.120.123 > 10.10.50.230.44608: UDP, length 48
        00:59:02.576259 IP 10.10.50.230.54479 > 192.168.10.120.123: UDP, length 48
        00:59:02.576371 IP 10.10.50.230.54479 > 192.168.10.120.123: UDP, length 48
        00:59:02.576552 IP 192.168.10.120.123 > 10.10.50.230.54479: UDP, length 48
        00:59:02.576558 IP 192.168.10.120.123 > 10.10.50.230.54479: UDP, length 48
        00:59:04.587321 IP 10.10.50.230.34257 > 192.168.10.120.123: UDP, length 48
        00:59:04.587386 IP 10.10.50.230.34257 > 192.168.10.120.123: UDP, length 48
        00:59:04.587550 IP 192.168.10.120.123 > 10.10.50.230.34257: UDP, length 48
        00:59:04.587556 IP 192.168.10.120.123 > 10.10.50.230.34257: UDP, length 48
        00:59:06.612532 IP 10.10.50.230.37136 > 192.168.10.120.123: UDP, length 48
        00:59:06.612592 IP 10.10.50.230.37136 > 192.168.10.120.123: UDP, length 48
        00:59:06.613552 IP 192.168.10.120.123 > 10.10.50.230.37136: UDP, length 48
        00:59:06.613578 IP 192.168.10.120.123 > 10.10.50.230.37136: UDP, length 48
        00:59:08.641801 IP 10.10.50.230.33174 > 192.168.10.120.123: UDP, length 48
        00:59:08.641915 IP 10.10.50.230.33174 > 192.168.10.120.123: UDP, length 48
        00:59:08.642548 IP 192.168.10.120.123 > 10.10.50.230.33174: UDP, length 48
        00:59:08.642570 IP 192.168.10.120.123 > 10.10.50.230.33174: UDP, length 48
        00:59:29.381935 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
        00:59:29.381971 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
        00:59:29.382608 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
        00:59:29.382641 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
        01:00:13.721904 IP 10.10.50.230.48115 > 192.168.10.120.123: UDP, length 48
        01:00:13.722019 IP 10.10.50.230.48115 > 192.168.10.120.123: UDP, length 48
        01:00:13.722520 IP 192.168.10.120.123 > 10.10.50.230.48115: UDP, length 48
        01:00:13.722524 IP 192.168.10.120.123 > 10.10.50.230.48115: UDP, length 48
        01:00:38.413534 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
        01:00:38.413568 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
        01:00:38.414569 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
        01:00:38.414598 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
        01:00:52.473322 IP 192.168.10.1.123 > 192.168.10.120.123: UDP, length 48
        01:00:52.473549 IP 192.168.10.120.123 > 192.168.10.1.123: UDP, length 48
        01:00:55.450351 IP 192.168.10.1.123 > 192.168.10.120.123: UDP, length 48
        01:00:55.450552 IP 192.168.10.120.123 > 192.168.10.1.123: UDP, length 48
        01:01:00.525365 IP 192.168.10.1.123 > 192.168.10.120.123: UDP, length 48
        01:01:00.525543 IP 192.168.10.120.123 > 192.168.10.1.123: UDP, length 48
        01:01:18.317945 IP 10.10.50.230.38268 > 192.168.10.120.123: UDP, length 48
        01:01:18.318057 IP 10.10.50.230.38268 > 192.168.10.120.123: UDP, length 48
        01:01:18.318613 IP 192.168.10.120.123 > 10.10.50.230.38268: UDP, length 48
        01:01:18.318635 IP 192.168.10.120.123 > 10.10.50.230.38268: UDP, length 48
        01:01:47.398970 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
        01:01:47.399009 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
        01:01:47.399617 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
        01:01:47.399650 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
        01:02:05.525345 IP 192.168.10.1.123 > 192.168.10.120.123: UDP, length 48
        01:02:05.525544 IP 192.168.10.120.123 > 192.168.10.1.123: UDP, length 48
        01:02:22.690101 IP 10.10.50.230.44520 > 192.168.10.120.123: UDP, length 48
        01:02:22.690213 IP 10.10.50.230.44520 > 192.168.10.120.123: UDP, length 48
        01:02:22.690525 IP 192.168.10.120.123 > 10.10.50.230.44520: UDP, length 48
        01:02:22.690546 IP 192.168.10.120.123 > 10.10.50.230.44520: UDP, length 48
        01:02:54.378938 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
        01:02:54.378974 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
        01:02:54.379592 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
        01:02:54.379623 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
        01:03:09.525230 IP 192.168.10.1.123 > 192.168.10.120.123: UDP, length 48
        01:03:09.525545 IP 192.168.10.120.123 > 192.168.10.1.123: UDP, length 48
        01:03:27.350112 IP 10.10.50.230.52709 > 192.168.10.120.123: UDP, length 48
        01:03:27.350221 IP 10.10.50.230.52709 > 192.168.10.120.123: UDP, length 48
        01:03:27.350617 IP 192.168.10.120.123 > 10.10.50.230.52709: UDP, length 48
        01:03:27.350637 IP 192.168.10.120.123 > 10.10.50.230.52709: UDP, length 48

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @ARAMP1
          last edited by

          @ARAMP1 said in NTP Issue:

          01:02:05.525345 IP 192.168.10.1.123 > 192.168.10.120.123: UDP, length 48
          01:02:05.525544 IP 192.168.10.120.123 > 192.168.10.1.123: UDP, length 48

          I take it that is your pfsense IP at 10.1 - can you download that and attach the pcap.. For example - here is pcap I did earlier

          packetcapture-igb3-20240602095409.pcap

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • ARAMP1A
            ARAMP1 @johnpoz
            last edited by

            @johnpoz said in NTP Issue:

            @ARAMP1 well that is interesting.. So the devices on different networks sync fine - but the pfsense on the same network is not able to reach it??

            Your not doing anything with ethernet filtering, nor any floating rules for outbound filtering?

            As a test - your truenas can act as ntp server I would assume.. Can you point pfsense to it?

            Example - just pointed pfsense to my nas.

            nasntp.jpg

            notice it shows the 9.10 address of my nas, and it shows its ref as my pi ntp server the 3.32 IP

            Just tried pointing it to a couple truenas servers I have on different VLANs. Both are Unreach/Pending.

            The floating rules I have in place only have to do with CoDel traffic limiter and pfBlocker.

            ARAMP1A 1 Reply Last reply Reply Quote 0
            • ARAMP1A
              ARAMP1 @ARAMP1
              last edited by

              packetcapture-ix1-20240602201708.pcap

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @ARAMP1
                last edited by

                @ARAMP1 this seems a bit odd

                odd.jpg

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                ARAMP1A 2 Replies Last reply Reply Quote 0
                • ARAMP1A
                  ARAMP1 @johnpoz
                  last edited by

                  @johnpoz I'm looking at wireshark now, but I don't know what I'm looking at.

                  1 Reply Last reply Reply Quote 0
                  • ARAMP1A
                    ARAMP1 @johnpoz
                    last edited by

                    @johnpoz said in NTP Issue:

                    @ARAMP1 this seems a bit odd

                    odd.jpg

                    Something with the DNS server? Here's my setup.

                    DNS server.jpg

                    johnpozJ 2 Replies Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @ARAMP1
                      last edited by

                      @ARAMP1 no it wouldn't have anything to do with dns, because your pointing to an IP for the server.

                      I would think that ref ID would point to the IP your asking.. see in mine it shows my 192.168.3.32?

                      It might be like that because it has never gotten an answer? So it has no ref as of yet?

                      From your sniff you get an answer, so why would ntp think it can not reach that server?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @ARAMP1
                        last edited by

                        @ARAMP1 can you turn off ntp and validate nothing is listening on 123..

                        example

                        grep.jpg

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        ARAMP1A 1 Reply Last reply Reply Quote 0
                        • ARAMP1A
                          ARAMP1 @johnpoz
                          last edited by ARAMP1

                          packetcapture-ix1-20240602204723.pcap

                          I've still pointed clients at 192.168.10.120 directly, so that would still show something listening on port 123, right?

                          johnpozJ 1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @ARAMP1
                            last edited by

                            @ARAMP1 not clicked to not enable it

                            As you see when I disable it nothing is listening on 123

                            Also can you one you enable it again, post up your ntpd.conf

                            [23.09.1-RELEASE][admin@sg4860.home.arpa]/: cat /var/etc/ntpd.conf 
# 
# pfSense ntp configuration file 
# 

tinker panic 0 

# Orphan mode stratum and Maximum candidate NTP peers
tos orphan 12 maxclock 5


# Upstream Servers
server -4 192.168.3.32 iburst minpoll 6 maxpoll 10 prefer


enable stats
statistics clockstats loopstats peerstats
statsdir /var/log/ntp
logconfig =syncall +clockall +peerall +sysall
driftfile /var/db/ntpd.drift
restrict default kod limited nomodify nopeer notrap
restrict -6 default kod limited nomodify nopeer notrap
interface ignore all
interface ignore wildcard
interface listen igb2.1011
interface listen igb3
interface listen igb0
interface listen igb4
interface listen igb2
interface listen igb2.110
interface listen igb2.6
interface listen igb2.4
interface listen igb5
interface listen lo0
[23.09.1-RELEASE][admin@sg4860.home.arpa]/:

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            ARAMP1A 1 Reply Last reply Reply Quote 0
                            • ARAMP1A
                              ARAMP1 @johnpoz
                              last edited by

                              @johnpoz said in NTP Issue:

                              cat /var/etc/ntpd.conf

                              cmd prompt.jpg

                              johnpozJ 1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @ARAMP1
                                last edited by

                                @ARAMP1 ok the only thing that looks odd is your restrict 192.168.10.120 that is not really a network that is a host address. The network with /24 would be 192.168.10.0

                                After seeing yours noticed mine wasn't even listed... I removed mine completely because to be honest that is for clients wanting to talk to pfsense as their server. So you shouldn't even need that.

                                I would remove it, but that would be really crazy if that was the issue.

                                Nothing is there that makes any sense to why it wouldn't be working that I am seeing..

                                So you have no native network on the ix1 interface.. Only vlans.. I take it ix1.10 is your 192.168.10 interface..

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                ARAMP1A 1 Reply Last reply Reply Quote 1
                                • ARAMP1A
                                  ARAMP1 @johnpoz
                                  last edited by

                                  @johnpoz I'm not following when you say "I would remove it". What would/did you remove?

                                  I have a native network on the ix1 interface but it's not enabled.

                                  INterfaces 3.jpg

                                  GertjanG 1 Reply Last reply Reply Quote 0
                                  • GertjanG
                                    Gertjan @ARAMP1
                                    last edited by

                                    @ARAMP1 said in NTP Issue:

                                    I'm not following when you say "I would remove it". What would/did you remove?

                                    Here :

                                    4e3e26db-fdfc-4902-abcf-6a64f15ce8c3-image.png

                                    No "help me" PM's please. Use the forum, the community will thank you.
                                    Edit : and where are the logs ??

                                    1 Reply Last reply Reply Quote 1
                                    • JonathanLeeJ
                                      JonathanLee
                                      last edited by

                                      One other small note:

                                      Anyone remember that authentication ticket that has been open for years with NTP, someone named Mathew fixed it and has a pull in the system no one has reviewed it yet, it fixed the GUI issue and also some other items with the pool for NTP.

                                      @MatthewA1 @LamaZ

                                      https://github.com/pfsense/pfsense/pull/4658.diff

                                      Did this github ever get merged?

                                      847e417b5612f28bc1e84ca028a980df9c5c57a7

                                      I can pull it in patches now

                                      Make sure to upvote

                                      M 1 Reply Last reply Reply Quote 1
                                      • M
                                        MatthewA1 @JonathanLee
                                        last edited by

                                        @JonathanLee Officially been 6 months since the last feedback I've gotten... PR is still open with the "Changes Requested" label applied even though I made the requested changes

                                        JonathanLeeJ 1 Reply Last reply Reply Quote 0
                                        • JonathanLeeJ
                                          JonathanLee @MatthewA1
                                          last edited by

                                          @MatthewA1 push it to the new development version see what happens, I think that older thread is not being looked at any longer

                                          Make sure to upvote

                                          1 Reply Last reply Reply Quote 1
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            The PR is against master so that would be 2.8-dev at this point.

                                            M 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.