Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NTP set to time.google.com not working after reboot

    Scheduled Pinned Locked Moved General pfSense Questions
    40 Posts 5 Posters 944 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      rpsmith
      last edited by

      I actually have these NTP settings:

      time1.google.com - Prefer - Server
      time2.google.com - Prefer - Server
      time3.google.com - Prefer - Server
      time4.google.com - Prefer - Server
      us.pool.ntp.org - Prefer not checked - Pool

      The us.pool.ntp.org is what gets used after a reboot but stopping and restarting the NTP services switches over to a Google server.

      also, IPV6 is disabled.

      Roy...

      1 Reply Last reply Reply Quote 0
      • R
        rpsmith
        last edited by

        and the status looks like this:

        Pool Placeholder us.pool.ntp.org .POOL. 16 p - 64 0 0.000 +0.000 0.000
        Unreach/Pending 2001:4860:4806:: .INIT. 16 u - 512 0 0.000 +0.000 0.000
        Unreach/Pending 2001:4860:4806:4:: .INIT. 16 u - 512 0 0.000 +0.000 0.000
        Unreach/Pending 2001:4860:4806:8:: .INIT. 16 u - 512 0 0.000 +0.000 0.000
        Unreach/Pending 2001:4860:4806:c:: .INIT. 16 u - 512 0 0.000 +0.000 0.000
        Active Peer 72.30.35.88 31.60.135.175 2 u 32 128 377 34.383 -0.645 0.074
        Candidate 158.51.99.19 17.253.26.125 3 u 57 128 377 23.598 -0.078 0.052
        Candidate 23.142.248.8 173.162.192.156 2 u 18 128 377 9.630 +0.256 0.226

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @rpsmith
          last edited by johnpoz

          @rpsmith so looks like its trying to talk to time at google via IPv6.. Maybe its taking a while for your ipv6 to come up on a reboot? Change your ntp server to prefer IPv4 Your currently talking to IPv4 for ntp from that.

          Or ipv6 just isn't working and it finally fails over to IPv4..

          Or use IPv4 address for time google and not the fqdn.

          I don't see AAAA for us.pool.ntp.org - so if your having issue with IPv6 - that could be why it jumps to using IPv4 for that. And gets an answer.

          ;; QUESTION SECTION:
          ;us.pool.ntp.org.               IN      AAAA
          
          ;; AUTHORITY SECTION:
          pool.ntp.org.           1300    IN      SOA     c.ntpns.org. hostmaster.pool.ntp.org. 1748189843 5400 5400 1209600 3600
          

          You say it starts working after a while? Check if talking IPv4 or IPv6 to time google when it shows talking to timeX.google.com

          Now coming back to me - believe the only ntp.org that comes back with IPv6 is 2.us.pool.ntp.org or 2.pool.ntp.org etc..

          ;; QUESTION SECTION:
          ;2.us.pool.ntp.org.             IN      AAAA
          
          ;; ANSWER SECTION:
          2.us.pool.ntp.org.      130     IN      AAAA    2600:3c00:e000:318::1
          2.us.pool.ntp.org.      130     IN      AAAA    2600:1702:7400:9ac0::314:5c
          2.us.pool.ntp.org.      130     IN      AAAA    2600:3c00::f03c:91ff:fe96:a6
          2.us.pool.ntp.org.      130     IN      AAAA    2603:c020:0:8369:0:ba11:ba11:ba1
          

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • R
            rpsmith
            last edited by

            If I only use "time.google.com" set as Pool and no other entry I get "No active peers available" after a reboot bet restarting the NTP service it works.

            Roy...

            1 Reply Last reply Reply Quote 0
            • R
              rpsmith
              last edited by

              Changing DNS to IPv4 made no difference.

              Roy...

              1 Reply Last reply Reply Quote 0
              • R
                rpsmith
                last edited by

                setting it to 216.239.35.12 as a Pool works.

                Roy...

                1 Reply Last reply Reply Quote 0
                • R
                  rpsmith
                  last edited by

                  Under: | System | Advanced | Networking |
                  I have "Allow IPv6" unchecked.

                  Roy...

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • R
                    rpsmith
                    last edited by

                    Enabling IPv6 in | System | Advanced | Networking | made no difference.

                    I forward all my DNS request to my two Pi-Hole servers. I wounder if that could be causing the problem. I'll try 1.1.1.1 and see if that helps.

                    Roy...

                    1 Reply Last reply Reply Quote 0
                    • R
                      rpsmith
                      last edited by

                      That didn't help!

                      Roy...

                      1 Reply Last reply Reply Quote 0
                      • R
                        rpsmith
                        last edited by

                        The only configuration I can get to work immediately after a reboot is:

                        216.239.35.12 set to Pool.

                        Roy...

                        1 Reply Last reply Reply Quote 0
                        • R
                          rpsmith
                          last edited by

                          I guess for now I'm going with this:

                          216.239.35.0 - Server
                          216.239.35.4 - Server
                          216.239.35.8 - Server
                          216.239.35.12 - Server

                          I should be OK as long as Google sticks with those addresses.

                          Roy...

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @rpsmith
                            last edited by

                            @rpsmith said in NTP set to time.google.com not working after reboot:

                            I have "Allow IPv6" unchecked.

                            well that would actively block all IPv6 - even if pfsense had a ipv6 address your not going anywhere..

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • R
                              rpsmith
                              last edited by

                              It didn't matter whether is was allowed or not it still didn't work. Why does pfSense prefer IPv6 by default or does it?

                              Roy...

                              1 Reply Last reply Reply Quote 0
                              • R
                                rpsmith
                                last edited by rpsmith

                                Got this from Grok3:

                                "Google supports IPv6, and time.google.com may return an AAAA record like the one above. Google only serves AAAA records to clients with good IPv6 connectivity to optimize performance."

                                So is there anything pfSense can do to stop google's DNS servers from giving out IPv6 addresses instead of IPv4? My firewall only have IPv4 addresses on the WAN.

                                Also, why does it resolve properly when I restart the NTP service?

                                Roy...

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @rpsmith
                                  last edited by johnpoz

                                  @rpsmith said in NTP set to time.google.com not working after reboot:

                                  Google only serves AAAA records to clients with good IPv6 connectivity to optimize performance.

                                  that is highly unlikely.. AAAA is returned even over IPv4 - I get answers and I sure am not talking to them via IPv6 when I do my query to 8.8.8.8 for dns, etc..

                                  The services prob drops over to IPv4 then.. I would suggest you prefer IPv4 down near the bottom of the ntp settings page.

                                  All things that have IPv6 try and prefer IPv6 over IPv4 if they have a valid address. I would be really curious do you actually have IPv6? when you allow it via that checkbox.. Try and ping say at

                                  time1.google.com. 3600 IN AAAA 2001:4860:4806::

                                  [24.11-RELEASE][admin@sg4860.home.arpa]/: ping 2001:4860:4806::
                                  PING(56=40+8+8 bytes) 2001:470:1f10:2f6::2 --> 2001:4860:4806::
                                  16 bytes from 2001:4860:4806::, icmp_seq=0 hlim=119 time=8.586 ms
                                  16 bytes from 2001:4860:4806::, icmp_seq=1 hlim=119 time=8.419 ms
                                  16 bytes from 2001:4860:4806::, icmp_seq=2 hlim=119 time=8.737 ms
                                  16 bytes from 2001:4860:4806::, icmp_seq=3 hlim=119 time=9.745 ms
                                  

                                  If you have no IPv6 address, and don't want anything to get a AAAA response almost anything will ask for both A and AAAA when you lookup something, even if it doesn't have an IPv6 address - yeah its stupid if you ask me, but that is not a pfsense/freebsd thing - that is just a stupid shortcut OSes and applications take..

                                  You can set unbound not to use IPv6 and not to return IPv6 addresses..

                                  settings.jpg

                                  firefox is horrible with doing that. but you can disable it in firefox for example with

                                  firefox.jpg

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  P 1 Reply Last reply Reply Quote 0
                                  • R
                                    rpsmith
                                    last edited by

                                    I tried setting the NTP service to IPv4 but that made no difference. Also my WAN interface is set to IP configuration type set to None.

                                    This smells like a BSD or pfSense bug to me but I'm not a programmer.

                                    Roy...

                                    1 Reply Last reply Reply Quote 0
                                    • P
                                      Patch @johnpoz
                                      last edited by Patch

                                      I thought KEA didn’t like domain names in NTP

                                      1 Reply Last reply Reply Quote 0
                                      • R
                                        rpsmith
                                        last edited by rpsmith

                                        I'm not using KEA and it works flawlessly when I restart the NTP service.

                                        Last time I tried switching to KEA it stop renewing leases and I had to scramble to reset a bunch of firewalls to stop using it. I'm not impressed.

                                        Roy...

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @rpsmith
                                          last edited by johnpoz

                                          @rpsmith kea would have zero to do with dns or ntp - ZERO!!!

                                          See my edit above about setting ntp to prefer IPv4 dns, and also how to stop unbound using IPv6 or trying and or answering a client that asks for a AAAA

                                          Kea doesn't like fqdn for ntp that you would hand to your clients.. Because per RFC setting a ntp server in dhcp is an IP only thing.. ISC and pfsense just resolves it before handing it out via a dhcp lease to some client. maybe kea in the furture or current iteration on pfsense does that now - but its bad to let clients people think you can put in fqdn for ntp server to hand to clients - because the dhcp that is not borked isn't going to do that.. The rfc clearly states IP for ntp servers. That pfsense ever allowed the option in the first place was a mistake if you ask me.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          P 1 Reply Last reply Reply Quote 0
                                          • R
                                            rpsmith
                                            last edited by

                                            I'm not using unbound. I'm using forwarder to forward DNS lockups to my two pi-holes.

                                            Roy...

                                            johnpozJ 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.