Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Time is not syncing

    Scheduled Pinned Locked Moved General pfSense Questions
    62 Posts 6 Posters 14.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • brunovicB
      brunovic
      last edited by

      @NogBadTheBad I've already done that too with the same results.0_1528991697118_Capture02.JPG

      NogBadTheBadN 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        Ok so your resolving, but ntp not able to reach or is not resolving? Place a specific IP in there vs FQDN.

        What do you have listed for interface that ntp is listening on? There was a recent there were a user was seeing a problem that ntp could not query unless they selected the wan interface. Even though that should not be required, unless you had maybe messed with your outbound nat.

        Are you trying to force all traffic through a vpn? your doing something odd with pfsense dns for sure since the only IP listed in pfsense for using the unbound resolver is the loopback, like you see in my output. But your also listing opendns.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        brunovicB 1 Reply Last reply Reply Quote 0
        • brunovicB
          brunovic @johnpoz
          last edited by

          @johnpoz I am not sure why 0.north-america.pool.ntp.org was cut off in the Status/NTP section but it was configured correctly in the NTP config and it resolves perfectly fine.

          0_1528991917838_Capture04.JPG

          1 Reply Last reply Reply Quote 0
          • NogBadTheBadN
            NogBadTheBad @brunovic
            last edited by

            @brunovic

            [2.4.3-RELEASE][admin@pfsense]/root: ntpq -pn
                 remote           refid      st t when poll reach   delay   offset  jitter
            ==============================================================================
             0.pool.ntp.org  .POOL.          16 p    -   64    0    0.000    0.000   0.000
             1.pool.ntp.org  .POOL.          16 p    -   64    0    0.000    0.000   0.000
             2.pool.ntp.org  .POOL.          16 p    -   64    0    0.000    0.000   0.000
             3.pool.ntp.org  .POOL.          16 p    -   64    0    0.000    0.000   0.000
            -2a01:7e00::f03c 85.199.214.98    2 u  334  512  377   10.483   -0.018   0.166
            +185.182.62.7    85.199.214.102   2 u   92  512  377    9.679   -0.223   0.409
            *87.242.168.84   .UPPS.           1 u  133  512  377   20.003    0.220   0.106
            -2001:1b40:5000: 188.39.213.7     2 u  324  512  377   10.234    2.004   0.296
            -83.137.225.103  193.190.230.66   2 u  199  512  377   10.425    0.849   0.296
            +188.39.213.7    .GPS.            1 u  432  512  377   16.887    0.036   4.039
            [2.4.3-RELEASE][admin@pfsense]/
            

            0_1528991888081_Untitled.jpeg

            Works fine here, I know thats not of any help.

            Andy

            1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

            1 Reply Last reply Reply Quote 0
            • brunovicB
              brunovic
              last edited by brunovic

              These are the results when I put the IP addresses directly in. Where do I find out what interface NTP is listening on?

              0_1528992318854_Capture05.JPG

              0_1528992358185_Capture06.JPG

              1 Reply Last reply Reply Quote 0
              • beremonavabiB
                beremonavabi
                last edited by beremonavabi

                Here's a link to my thread (that johnpoz mentioned) on the same problem:

                https://forum.netgate.com/topic/131506/ntp-not-working-solved-mostly

                For me, I have to have WAN selected under Services > NTP in the Interfaces section. I've been utterly unable to find any reason for this since it shouldn't be necessary.

                SG-4860, pfSense 2.4.5-RELEASE-p1 (amd64)

                brunovicB 1 Reply Last reply Reply Quote 1
                • brunovicB
                  brunovic @beremonavabi
                  last edited by

                  @beremonavabi said in Time is not syncing:

                  Here's a link to my thread (that johnpoz mentioned) on the same problem:

                  https://forum.netgate.com/topic/131506/ntp-not-working-solved-mostly

                  For me, I have to have WAN selected under Services > NTP in the Interfaces section. I've been utterly unable to find any reason for this since it shouldn't be necessary.

                  This solution worked for me. Thank you.

                  0_1528992756723_Capture07.JPG

                  beremonavabiB 1 Reply Last reply Reply Quote 0
                  • beremonavabiB
                    beremonavabi @brunovic
                    last edited by

                    @brunovic
                    I don't like having my WAN selected for NTP to listen to. But, since that's the only way I've found to be able to get NTP to run, I guess I have to live with it.

                    SG-4860, pfSense 2.4.5-RELEASE-p1 (amd64)

                    NogBadTheBadN 1 Reply Last reply Reply Quote 1
                    • NogBadTheBadN
                      NogBadTheBad @beremonavabi
                      last edited by

                      @beremonavabi

                      Does it now work ?

                      You both shouldn't need to have it listening on the WAN interface.

                      Andy

                      1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                      beremonavabiB 1 Reply Last reply Reply Quote 0
                      • brunovicB
                        brunovic @johnpoz
                        last edited by

                        @johnpoz so it looks like my outbound NAT is manually configured. How will this prevent NTP from syncing?

                        0_1528993260522_Capture08.JPG

                        brunovicB 1 Reply Last reply Reply Quote 0
                        • beremonavabiB
                          beremonavabi @NogBadTheBad
                          last edited by

                          @nogbadthebad said in Time is not syncing:

                          @beremonavabi

                          Does it now work ?

                          You both shouldn't need to have it listening on the WAN interface.

                          NTP will ONLY run on my SG-4860 if WAN is selected to listen to (the gory details of everything I've tried are in the thread I referenced, above). I agree that the WAN shouldn't be necessary. But, for no reason I can come up with, it turns out to be necessary in my case.

                          Looking over some of brunovic's other posts, it looks like he's using a VPN. I am, too. It's possible that's a relationship, but I just don't see why using a VPN might interfere with NTP.

                          SG-4860, pfSense 2.4.5-RELEASE-p1 (amd64)

                          brunovicB NogBadTheBadN johnpozJ 3 Replies Last reply Reply Quote 0
                          • brunovicB
                            brunovic @beremonavabi
                            last edited by

                            @beremonavabi I use a VPN for remote access into my network but not for outbound traffic. Is that how you are using it?

                            beremonavabiB 1 Reply Last reply Reply Quote 0
                            • NogBadTheBadN
                              NogBadTheBad @beremonavabi
                              last edited by NogBadTheBad

                              @beremonavabi said in Time is not syncing:

                              @nogbadthebad said in Time is not syncing:

                              @beremonavabi

                              Does it now work ?

                              You both shouldn't need to have it listening on the WAN interface.

                              NTP will ONLY run on my SG-4860 if WAN is selected to listen to (the gory details of everything I've tried are in the thread I referenced, above). I agree that the WAN shouldn't be necessary. But, for no reason I can come up with, it turns out to be necessary in my case.

                              Looking over some of brunovic's other posts, it looks like he's using a VPN. I am, too. It's possible that's a relationship, but I just don't see why using a VPN might interfere with NTP.

                              I run a IKEv2 IPsec VPN ( inbound ) too I've got Automatic outbound NAT rule generation set.

                              Andy

                              1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                              1 Reply Last reply Reply Quote 0
                              • beremonavabiB
                                beremonavabi @brunovic
                                last edited by

                                @brunovic I've got OpenVPN clients running on my pfSense box to my VPN provider (AirVPN). I've also got a server running on it so our phones can use the VPN.

                                SG-4860, pfSense 2.4.5-RELEASE-p1 (amd64)

                                brunovicB 1 Reply Last reply Reply Quote 0
                                • brunovicB
                                  brunovic @beremonavabi
                                  last edited by

                                  @beremonavabi ah no I am not using the client on my pfsense just the server.

                                  beremonavabiB 1 Reply Last reply Reply Quote 0
                                  • beremonavabiB
                                    beremonavabi @brunovic
                                    last edited by

                                    @brunovic said in Time is not syncing:

                                    @beremonavabi ah no I am not using the client on my pfsense just the server.

                                    Well, an OpenVPN server commonality might be a start. Mine is listening on port 443. My firewall rules on the WAN look like:

                                    0_1528994663634_20180604 -- Firewall Rules WAN.PNG

                                    Like you, my NAT rules are Manual. Outside of your specific ports, mine look similar:

                                    0_1528994721603_20180610 -- pfSense Firewall NAT Outbound.PNG

                                    For DNS, I’m using DNS Resolver in NON-Forwarding mode. It’s active for all my local LAN-type interfaces (not WAN). Though, since I've checked with NTP using actual IP addresses instead of pool names (as you did), I can't see how this could be DNS related.

                                    SG-4860, pfSense 2.4.5-RELEASE-p1 (amd64)

                                    1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @beremonavabi
                                      last edited by

                                      @beremonavabi said in Time is not syncing:

                                      NTP will ONLY run on my SG-4860 if WAN is selected to listen

                                      I have sg4860, I run both vpn servers on multiple instances 443 tcp, 1194 udp and also a vpn client connection to a vps out on the net running openvpn-as..

                                      But I am NOT pulling routes from that connection and only policy route out to that vpn if need a client to take that path.. And I am NOT listening on the wan port and have zero issues with ntp talking to outbound ntp per previous screen shots.

                                      So you clearly have something messed up in your configuration causing this problem there is zero reason that ntp should have to listen on wan to talk to ntp servers on the internet.

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      beremonavabiB 1 Reply Last reply Reply Quote 0
                                      • beremonavabiB
                                        beremonavabi @johnpoz
                                        last edited by beremonavabi

                                        @johnpoz said in Time is not syncing:

                                        @beremonavabi said in Time is not syncing:

                                        NTP will ONLY run on my SG-4860 if WAN is selected to listen

                                        I have sg4860, I run both vpn servers on multiple instances 443 tcp, 1194 udp and also a vpn client connection to a vps out on the net running openvpn-as..

                                        But I am NOT pulling routes from that connection and only policy route out to that vpn if need a client to take that path.. And I am NOT listening on the wan port and have zero issues with ntp talking to outbound ntp per previous screen shots.

                                        So you clearly have something messed up in your configuration causing this problem there is zero reason that ntp should have to listen on wan to talk to ntp servers on the internet.

                                        I'm also not pulling routes. I'm mostly clueless about this, but my routes look fine, to me:

                                        IPv4 Routes
                                        Destination	Gateway	Flags	Use	Mtu	Netif	Expire
                                        0.0.0.0/1	10.4.0.1	UGS	16952	1500	ovpnc1	
                                        default		[my WAN IP]	UGS	34	1500	igb1	
                                        10.4.0.0/16	10.4.0.1	UGS	0	1500	ovpnc1	
                                        10.4.0.1	link#12	UH	371622	1500	ovpnc1	
                                        10.4.0.14	link#12	UHS	0	16384	lo0	
                                        10.8.0.0/16	10.8.0.1	UGS	0	1500	ovpnc2	
                                        10.8.0.1	link#13	UH	371535	1500	ovpnc2	
                                        10.8.0.27	link#13	UHS	0	16384	lo0	
                                        [my WAN net]/24	link#2	U	371654	1500	igb1	
                                        [my WAN IP]	link#2	UHS	0	16384	lo0	
                                        127.0.0.1	link#7	UH	6821	16384	lo0	
                                        128.0.0.0/1	10.4.0.1	UGS	84534	1500	ovpnc1	
                                        192.168.1.0/24	link#1	U	0	1500	igb0	
                                        192.168.1.1	link#1	UHS	0	16384	lo0	
                                        192.168.10.0/24	link#3	U	0	1500	igb2	
                                        192.168.10.1	link#3	UHS	0	16384	lo0	
                                        192.168.20.0/24	link#4	U	10946342	1500	igb3	
                                        192.168.20.1	link#4	UHS	0	16384	lo0	
                                        192.168.30.0/24	link#5	U	464495	1500	igb4	
                                        192.168.30.1	link#5	UHS	0	16384	lo0	
                                        192.168.40.0/24	link#6	U	0	1500	igb5	
                                        192.168.40.1	link#6	UHS	0	16384	lo0	
                                        192.168.200.0/24	192.168.200.2	UGS	333989	1500	ovpns3	
                                        192.168.200.1	link#11	UHS	743340	16384	lo0	
                                        192.168.200.2	link#11	UH	33730	1500	ovpns3	
                                        [VPN address]/32	[my WAN IP]	UGS	456678	1500	igb1	
                                        [VPN address]/32	[my WAN IP]	UGS	5024988	1500	igb1	
                                        
                                        

                                        EDIT: Since only a handful of us have had this issue, I agree that I must have something messed up in my configuration. But I have no idea what it is. And, since nothing in my logs leaps out at me as being a problem, I don't even know where to look. I've pretty much given up on this and am just living with NTP on WAN.

                                        SG-4860, pfSense 2.4.5-RELEASE-p1 (amd64)

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          @beremonavabi said in Time is not syncing:

                                          0.0.0.0/1 10.4.0.1 UGS 16952 1500 ovpnc1

                                          No your pulling routes if you have something like that..

                                          You blocked routes from your client config? See how have only my wan default route and only routes for my client connection are the network its connected too.0_1529004862429_notpull.png

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          beremonavabiB 1 Reply Last reply Reply Quote 0
                                          • beremonavabiB
                                            beremonavabi @johnpoz
                                            last edited by

                                            @johnpoz I've got the same "Don't pull routes" box checked in my VPN clients. The 0.0.0.0/1 (and the 128.0.0.0/1) routes are added with the "redirect-gateway def1" Custom Option I'm using. That redirects all my traffic through the VPN (whereas you are policy routing specific clients), but leaves the default route untouched so the firewall, itself, can get through the WAN:

                                            https://forum.netgate.com/topic/115760/firewall-traffic-needs-redirect-gateway-def1-to-route-thru-vpn

                                            That being said, I had also been wondering if that could be causing the issue. But, since the OP of this thread isn't using a VPN client on pfSense, he shouldn't have those routes set. So, if that were the problem, he shouldn't be seeing it. Also, from my other thread I referenced earlier, I'm pretty sure that's what I tried to work around with a specific Outgoing NAT rule to allow UDP 123 traffic to go through the WAN:

                                            0_1529006304514_20180610 -- pfSense NTP Fix Question.PNG

                                            That didn't work. So, obviously it didn't do what I thought it might.

                                            Still, that's all on the routing side. I still don't understand why having NTP listen on the WAN would allow this to work. AFAIK, the NTP client on pfSense sends out traffic asking for the time and gets a response. There shouldn't be anything legitimate arriving unsolicited from the internet. So, the incoming NTP traffic ought to get right through the firewall since it's in response to a legitimate request.

                                            Do you have any blocking rules on your WAN to block incoming private/bogon networks? Or, do you just let the default "block everything" behavior in pfSense handle that? Could the NTP traffic from my setup be somehow avoiding NAT, going out with my private address on it, and getting blocked on the way back in by my rules?

                                            SG-4860, pfSense 2.4.5-RELEASE-p1 (amd64)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.