Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NTP Issue

    Scheduled Pinned Locked Moved General pfSense Questions
    98 Posts 11 Posters 10.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • ARAMP1A
      ARAMP1
      last edited by

      Here's a short run of the packet capture...

      00:56:11.413566 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
      00:56:11.413612 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
      00:56:11.414620 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
      00:56:11.414652 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
      00:57:17.413522 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
      00:57:17.413531 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
      00:57:17.414624 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
      00:57:17.414659 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
      00:58:23.373022 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
      00:58:23.373061 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
      00:58:23.373684 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
      00:58:23.373718 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
      00:58:42.477178 IP 10.10.50.230.44863 > 192.168.10.120.123: UDP, length 48
      00:58:42.477281 IP 10.10.50.230.44863 > 192.168.10.120.123: UDP, length 48
      00:58:42.477576 IP 192.168.10.120.123 > 10.10.50.230.44863: UDP, length 48
      00:58:42.477597 IP 192.168.10.120.123 > 10.10.50.230.44863: UDP, length 48
      00:58:43.586214 IP 10.10.50.230.50913 > 192.168.10.120.123: UDP, length 48
      00:58:43.586317 IP 10.10.50.230.50913 > 192.168.10.120.123: UDP, length 48
      00:58:43.586555 IP 192.168.10.120.123 > 10.10.50.230.50913: UDP, length 48
      00:58:43.586560 IP 192.168.10.120.123 > 10.10.50.230.50913: UDP, length 48
      00:58:45.604892 IP 10.10.50.230.41040 > 192.168.10.120.123: UDP, length 48
      00:58:45.605003 IP 10.10.50.230.41040 > 192.168.10.120.123: UDP, length 48
      00:58:45.605557 IP 192.168.10.120.123 > 10.10.50.230.41040: UDP, length 48
      00:58:45.605580 IP 192.168.10.120.123 > 10.10.50.230.41040: UDP, length 48
      00:58:47.636203 IP 10.10.50.230.54265 > 192.168.10.120.123: UDP, length 48
      00:58:47.636249 IP 10.10.50.230.54265 > 192.168.10.120.123: UDP, length 48
      00:58:47.636552 IP 192.168.10.120.123 > 10.10.50.230.54265: UDP, length 48
      00:58:47.636578 IP 192.168.10.120.123 > 10.10.50.230.54265: UDP, length 48
      00:58:49.778857 IP 10.10.50.230.56448 > 192.168.10.120.123: UDP, length 48
      00:58:49.778967 IP 10.10.50.230.56448 > 192.168.10.120.123: UDP, length 48
      00:58:49.779532 IP 192.168.10.120.123 > 10.10.50.230.56448: UDP, length 48
      00:58:49.779552 IP 192.168.10.120.123 > 10.10.50.230.56448: UDP, length 48
      00:58:51.786147 IP 10.10.50.230.36563 > 192.168.10.120.123: UDP, length 48
      00:58:51.786273 IP 10.10.50.230.36563 > 192.168.10.120.123: UDP, length 48
      00:58:51.786525 IP 192.168.10.120.123 > 10.10.50.230.36563: UDP, length 48
      00:58:51.786529 IP 192.168.10.120.123 > 10.10.50.230.36563: UDP, length 48
      00:58:53.816726 IP 10.10.50.230.58706 > 192.168.10.120.123: UDP, length 48
      00:58:53.816798 IP 10.10.50.230.58706 > 192.168.10.120.123: UDP, length 48
      00:58:53.817676 IP 192.168.10.120.123 > 10.10.50.230.58706: UDP, length 48
      00:58:53.817681 IP 192.168.10.120.123 > 10.10.50.230.58706: UDP, length 48
      00:58:54.780841 IP 10.10.50.230.56213 > 192.168.10.120.123: UDP, length 48
      00:58:54.780910 IP 10.10.50.230.56213 > 192.168.10.120.123: UDP, length 48
      00:58:54.781525 IP 192.168.10.120.123 > 10.10.50.230.56213: UDP, length 48
      00:58:54.781533 IP 192.168.10.120.123 > 10.10.50.230.56213: UDP, length 48
      00:58:56.791962 IP 10.10.50.230.46158 > 192.168.10.120.123: UDP, length 48
      00:58:56.792080 IP 10.10.50.230.46158 > 192.168.10.120.123: UDP, length 48
      00:58:56.792530 IP 192.168.10.120.123 > 10.10.50.230.46158: UDP, length 48
      00:58:56.792551 IP 192.168.10.120.123 > 10.10.50.230.46158: UDP, length 48
      00:58:58.467266 IP 10.10.50.230.54383 > 192.168.10.120.123: UDP, length 48
      00:58:58.467305 IP 10.10.50.230.54383 > 192.168.10.120.123: UDP, length 48
      00:58:58.467569 IP 192.168.10.120.123 > 10.10.50.230.54383: UDP, length 48
      00:58:58.467574 IP 192.168.10.120.123 > 10.10.50.230.54383: UDP, length 48
      00:59:00.508052 IP 10.10.50.230.44608 > 192.168.10.120.123: UDP, length 48
      00:59:00.508113 IP 10.10.50.230.44608 > 192.168.10.120.123: UDP, length 48
      00:59:00.508564 IP 192.168.10.120.123 > 10.10.50.230.44608: UDP, length 48
      00:59:00.508568 IP 192.168.10.120.123 > 10.10.50.230.44608: UDP, length 48
      00:59:02.576259 IP 10.10.50.230.54479 > 192.168.10.120.123: UDP, length 48
      00:59:02.576371 IP 10.10.50.230.54479 > 192.168.10.120.123: UDP, length 48
      00:59:02.576552 IP 192.168.10.120.123 > 10.10.50.230.54479: UDP, length 48
      00:59:02.576558 IP 192.168.10.120.123 > 10.10.50.230.54479: UDP, length 48
      00:59:04.587321 IP 10.10.50.230.34257 > 192.168.10.120.123: UDP, length 48
      00:59:04.587386 IP 10.10.50.230.34257 > 192.168.10.120.123: UDP, length 48
      00:59:04.587550 IP 192.168.10.120.123 > 10.10.50.230.34257: UDP, length 48
      00:59:04.587556 IP 192.168.10.120.123 > 10.10.50.230.34257: UDP, length 48
      00:59:06.612532 IP 10.10.50.230.37136 > 192.168.10.120.123: UDP, length 48
      00:59:06.612592 IP 10.10.50.230.37136 > 192.168.10.120.123: UDP, length 48
      00:59:06.613552 IP 192.168.10.120.123 > 10.10.50.230.37136: UDP, length 48
      00:59:06.613578 IP 192.168.10.120.123 > 10.10.50.230.37136: UDP, length 48
      00:59:08.641801 IP 10.10.50.230.33174 > 192.168.10.120.123: UDP, length 48
      00:59:08.641915 IP 10.10.50.230.33174 > 192.168.10.120.123: UDP, length 48
      00:59:08.642548 IP 192.168.10.120.123 > 10.10.50.230.33174: UDP, length 48
      00:59:08.642570 IP 192.168.10.120.123 > 10.10.50.230.33174: UDP, length 48
      00:59:29.381935 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
      00:59:29.381971 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
      00:59:29.382608 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
      00:59:29.382641 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
      01:00:13.721904 IP 10.10.50.230.48115 > 192.168.10.120.123: UDP, length 48
      01:00:13.722019 IP 10.10.50.230.48115 > 192.168.10.120.123: UDP, length 48
      01:00:13.722520 IP 192.168.10.120.123 > 10.10.50.230.48115: UDP, length 48
      01:00:13.722524 IP 192.168.10.120.123 > 10.10.50.230.48115: UDP, length 48
      01:00:38.413534 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
      01:00:38.413568 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
      01:00:38.414569 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
      01:00:38.414598 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
      01:00:52.473322 IP 192.168.10.1.123 > 192.168.10.120.123: UDP, length 48
      01:00:52.473549 IP 192.168.10.120.123 > 192.168.10.1.123: UDP, length 48
      01:00:55.450351 IP 192.168.10.1.123 > 192.168.10.120.123: UDP, length 48
      01:00:55.450552 IP 192.168.10.120.123 > 192.168.10.1.123: UDP, length 48
      01:01:00.525365 IP 192.168.10.1.123 > 192.168.10.120.123: UDP, length 48
      01:01:00.525543 IP 192.168.10.120.123 > 192.168.10.1.123: UDP, length 48
      01:01:18.317945 IP 10.10.50.230.38268 > 192.168.10.120.123: UDP, length 48
      01:01:18.318057 IP 10.10.50.230.38268 > 192.168.10.120.123: UDP, length 48
      01:01:18.318613 IP 192.168.10.120.123 > 10.10.50.230.38268: UDP, length 48
      01:01:18.318635 IP 192.168.10.120.123 > 10.10.50.230.38268: UDP, length 48
      01:01:47.398970 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
      01:01:47.399009 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
      01:01:47.399617 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
      01:01:47.399650 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
      01:02:05.525345 IP 192.168.10.1.123 > 192.168.10.120.123: UDP, length 48
      01:02:05.525544 IP 192.168.10.120.123 > 192.168.10.1.123: UDP, length 48
      01:02:22.690101 IP 10.10.50.230.44520 > 192.168.10.120.123: UDP, length 48
      01:02:22.690213 IP 10.10.50.230.44520 > 192.168.10.120.123: UDP, length 48
      01:02:22.690525 IP 192.168.10.120.123 > 10.10.50.230.44520: UDP, length 48
      01:02:22.690546 IP 192.168.10.120.123 > 10.10.50.230.44520: UDP, length 48
      01:02:54.378938 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
      01:02:54.378974 IP 192.168.60.251.123 > 192.168.10.120.123: UDP, length 48
      01:02:54.379592 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
      01:02:54.379623 IP 192.168.10.120.123 > 192.168.60.251.123: UDP, length 48
      01:03:09.525230 IP 192.168.10.1.123 > 192.168.10.120.123: UDP, length 48
      01:03:09.525545 IP 192.168.10.120.123 > 192.168.10.1.123: UDP, length 48
      01:03:27.350112 IP 10.10.50.230.52709 > 192.168.10.120.123: UDP, length 48
      01:03:27.350221 IP 10.10.50.230.52709 > 192.168.10.120.123: UDP, length 48
      01:03:27.350617 IP 192.168.10.120.123 > 10.10.50.230.52709: UDP, length 48
      01:03:27.350637 IP 192.168.10.120.123 > 10.10.50.230.52709: UDP, length 48

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @ARAMP1
        last edited by

        @ARAMP1 said in NTP Issue:

        01:02:05.525345 IP 192.168.10.1.123 > 192.168.10.120.123: UDP, length 48
        01:02:05.525544 IP 192.168.10.120.123 > 192.168.10.1.123: UDP, length 48

        I take it that is your pfsense IP at 10.1 - can you download that and attach the pcap.. For example - here is pcap I did earlier

        packetcapture-igb3-20240602095409.pcap

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • ARAMP1A
          ARAMP1 @johnpoz
          last edited by

          @johnpoz said in NTP Issue:

          @ARAMP1 well that is interesting.. So the devices on different networks sync fine - but the pfsense on the same network is not able to reach it??

          Your not doing anything with ethernet filtering, nor any floating rules for outbound filtering?

          As a test - your truenas can act as ntp server I would assume.. Can you point pfsense to it?

          Example - just pointed pfsense to my nas.

          nasntp.jpg

          notice it shows the 9.10 address of my nas, and it shows its ref as my pi ntp server the 3.32 IP

          Just tried pointing it to a couple truenas servers I have on different VLANs. Both are Unreach/Pending.

          The floating rules I have in place only have to do with CoDel traffic limiter and pfBlocker.

          ARAMP1A 1 Reply Last reply Reply Quote 0
          • ARAMP1A
            ARAMP1 @ARAMP1
            last edited by

            packetcapture-ix1-20240602201708.pcap

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @ARAMP1
              last edited by

              @ARAMP1 this seems a bit odd

              odd.jpg

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              ARAMP1A 2 Replies Last reply Reply Quote 0
              • ARAMP1A
                ARAMP1 @johnpoz
                last edited by

                @johnpoz I'm looking at wireshark now, but I don't know what I'm looking at.

                1 Reply Last reply Reply Quote 0
                • ARAMP1A
                  ARAMP1 @johnpoz
                  last edited by

                  @johnpoz said in NTP Issue:

                  @ARAMP1 this seems a bit odd

                  odd.jpg

                  Something with the DNS server? Here's my setup.

                  DNS server.jpg

                  johnpozJ 2 Replies Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @ARAMP1
                    last edited by

                    @ARAMP1 no it wouldn't have anything to do with dns, because your pointing to an IP for the server.

                    I would think that ref ID would point to the IP your asking.. see in mine it shows my 192.168.3.32?

                    It might be like that because it has never gotten an answer? So it has no ref as of yet?

                    From your sniff you get an answer, so why would ntp think it can not reach that server?

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @ARAMP1
                      last edited by

                      @ARAMP1 can you turn off ntp and validate nothing is listening on 123..

                      example

                      grep.jpg

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      ARAMP1A 1 Reply Last reply Reply Quote 0
                      • ARAMP1A
                        ARAMP1 @johnpoz
                        last edited by ARAMP1

                        packetcapture-ix1-20240602204723.pcap

                        I've still pointed clients at 192.168.10.120 directly, so that would still show something listening on port 123, right?

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @ARAMP1
                          last edited by

                          @ARAMP1 not clicked to not enable it

                          As you see when I disable it nothing is listening on 123

                          Also can you one you enable it again, post up your ntpd.conf

                          [23.09.1-RELEASE][admin@sg4860.home.arpa]/: cat /var/etc/ntpd.conf 
# 
# pfSense ntp configuration file 
# 

tinker panic 0 

# Orphan mode stratum and Maximum candidate NTP peers
tos orphan 12 maxclock 5


# Upstream Servers
server -4 192.168.3.32 iburst minpoll 6 maxpoll 10 prefer


enable stats
statistics clockstats loopstats peerstats
statsdir /var/log/ntp
logconfig =syncall +clockall +peerall +sysall
driftfile /var/db/ntpd.drift
restrict default kod limited nomodify nopeer notrap
restrict -6 default kod limited nomodify nopeer notrap
interface ignore all
interface ignore wildcard
interface listen igb2.1011
interface listen igb3
interface listen igb0
interface listen igb4
interface listen igb2
interface listen igb2.110
interface listen igb2.6
interface listen igb2.4
interface listen igb5
interface listen lo0
[23.09.1-RELEASE][admin@sg4860.home.arpa]/:

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          ARAMP1A 1 Reply Last reply Reply Quote 0
                          • ARAMP1A
                            ARAMP1 @johnpoz
                            last edited by

                            @johnpoz said in NTP Issue:

                            cat /var/etc/ntpd.conf

                            cmd prompt.jpg

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @ARAMP1
                              last edited by

                              @ARAMP1 ok the only thing that looks odd is your restrict 192.168.10.120 that is not really a network that is a host address. The network with /24 would be 192.168.10.0

                              After seeing yours noticed mine wasn't even listed... I removed mine completely because to be honest that is for clients wanting to talk to pfsense as their server. So you shouldn't even need that.

                              I would remove it, but that would be really crazy if that was the issue.

                              Nothing is there that makes any sense to why it wouldn't be working that I am seeing..

                              So you have no native network on the ix1 interface.. Only vlans.. I take it ix1.10 is your 192.168.10 interface..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              ARAMP1A 1 Reply Last reply Reply Quote 1
                              • ARAMP1A
                                ARAMP1 @johnpoz
                                last edited by

                                @johnpoz I'm not following when you say "I would remove it". What would/did you remove?

                                I have a native network on the ix1 interface but it's not enabled.

                                INterfaces 3.jpg

                                GertjanG 1 Reply Last reply Reply Quote 0
                                • GertjanG
                                  Gertjan @ARAMP1
                                  last edited by

                                  @ARAMP1 said in NTP Issue:

                                  I'm not following when you say "I would remove it". What would/did you remove?

                                  Here :

                                  4e3e26db-fdfc-4902-abcf-6a64f15ce8c3-image.png

                                  No "help me" PM's please. Use the forum, the community will thank you.
                                  Edit : and where are the logs ??

                                  1 Reply Last reply Reply Quote 1
                                  • JonathanLeeJ
                                    JonathanLee
                                    last edited by

                                    One other small note:

                                    Anyone remember that authentication ticket that has been open for years with NTP, someone named Mathew fixed it and has a pull in the system no one has reviewed it yet, it fixed the GUI issue and also some other items with the pool for NTP.

                                    @MatthewA1 @LamaZ

                                    https://github.com/pfsense/pfsense/pull/4658.diff

                                    Did this github ever get merged?

                                    847e417b5612f28bc1e84ca028a980df9c5c57a7

                                    I can pull it in patches now

                                    Make sure to upvote

                                    M 1 Reply Last reply Reply Quote 1
                                    • M
                                      MatthewA1 @JonathanLee
                                      last edited by

                                      @JonathanLee Officially been 6 months since the last feedback I've gotten... PR is still open with the "Changes Requested" label applied even though I made the requested changes

                                      JonathanLeeJ 1 Reply Last reply Reply Quote 0
                                      • JonathanLeeJ
                                        JonathanLee @MatthewA1
                                        last edited by

                                        @MatthewA1 push it to the new development version see what happens, I think that older thread is not being looked at any longer

                                        Make sure to upvote

                                        1 Reply Last reply Reply Quote 1
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          The PR is against master so that would be 2.8-dev at this point.

                                          M 1 Reply Last reply Reply Quote 0
                                          • M
                                            MatthewA1 @stephenw10
                                            last edited by

                                            @stephenw10 Should I have opened the PR against a branch for 2.7 when I first opened it instead of master? As of now, it is in the correct place though right?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.