Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Time is not syncing

    Scheduled Pinned Locked Moved General pfSense Questions
    62 Posts 6 Posters 14.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      Ok so your resolving, but ntp not able to reach or is not resolving? Place a specific IP in there vs FQDN.

      What do you have listed for interface that ntp is listening on? There was a recent there were a user was seeing a problem that ntp could not query unless they selected the wan interface. Even though that should not be required, unless you had maybe messed with your outbound nat.

      Are you trying to force all traffic through a vpn? your doing something odd with pfsense dns for sure since the only IP listed in pfsense for using the unbound resolver is the loopback, like you see in my output. But your also listing opendns.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      brunovicB 1 Reply Last reply Reply Quote 0
      • brunovicB
        brunovic @johnpoz
        last edited by

        @johnpoz I am not sure why 0.north-america.pool.ntp.org was cut off in the Status/NTP section but it was configured correctly in the NTP config and it resolves perfectly fine.

        0_1528991917838_Capture04.JPG

        1 Reply Last reply Reply Quote 0
        • NogBadTheBadN
          NogBadTheBad @brunovic
          last edited by

          @brunovic

          [2.4.3-RELEASE][admin@pfsense]/root: ntpq -pn
               remote           refid      st t when poll reach   delay   offset  jitter
          ==============================================================================
           0.pool.ntp.org  .POOL.          16 p    -   64    0    0.000    0.000   0.000
           1.pool.ntp.org  .POOL.          16 p    -   64    0    0.000    0.000   0.000
           2.pool.ntp.org  .POOL.          16 p    -   64    0    0.000    0.000   0.000
           3.pool.ntp.org  .POOL.          16 p    -   64    0    0.000    0.000   0.000
          -2a01:7e00::f03c 85.199.214.98    2 u  334  512  377   10.483   -0.018   0.166
          +185.182.62.7    85.199.214.102   2 u   92  512  377    9.679   -0.223   0.409
          *87.242.168.84   .UPPS.           1 u  133  512  377   20.003    0.220   0.106
          -2001:1b40:5000: 188.39.213.7     2 u  324  512  377   10.234    2.004   0.296
          -83.137.225.103  193.190.230.66   2 u  199  512  377   10.425    0.849   0.296
          +188.39.213.7    .GPS.            1 u  432  512  377   16.887    0.036   4.039
          [2.4.3-RELEASE][admin@pfsense]/
          

          0_1528991888081_Untitled.jpeg

          Works fine here, I know thats not of any help.

          Andy

          1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

          1 Reply Last reply Reply Quote 0
          • brunovicB
            brunovic
            last edited by brunovic

            These are the results when I put the IP addresses directly in. Where do I find out what interface NTP is listening on?

            0_1528992318854_Capture05.JPG

            0_1528992358185_Capture06.JPG

            1 Reply Last reply Reply Quote 0
            • beremonavabiB
              beremonavabi
              last edited by beremonavabi

              Here's a link to my thread (that johnpoz mentioned) on the same problem:

              https://forum.netgate.com/topic/131506/ntp-not-working-solved-mostly

              For me, I have to have WAN selected under Services > NTP in the Interfaces section. I've been utterly unable to find any reason for this since it shouldn't be necessary.

              SG-4860, pfSense 2.4.5-RELEASE-p1 (amd64)

              brunovicB 1 Reply Last reply Reply Quote 1
              • brunovicB
                brunovic @beremonavabi
                last edited by

                @beremonavabi said in Time is not syncing:

                Here's a link to my thread (that johnpoz mentioned) on the same problem:

                https://forum.netgate.com/topic/131506/ntp-not-working-solved-mostly

                For me, I have to have WAN selected under Services > NTP in the Interfaces section. I've been utterly unable to find any reason for this since it shouldn't be necessary.

                This solution worked for me. Thank you.

                0_1528992756723_Capture07.JPG

                beremonavabiB 1 Reply Last reply Reply Quote 0
                • beremonavabiB
                  beremonavabi @brunovic
                  last edited by

                  @brunovic
                  I don't like having my WAN selected for NTP to listen to. But, since that's the only way I've found to be able to get NTP to run, I guess I have to live with it.

                  SG-4860, pfSense 2.4.5-RELEASE-p1 (amd64)

                  NogBadTheBadN 1 Reply Last reply Reply Quote 1
                  • NogBadTheBadN
                    NogBadTheBad @beremonavabi
                    last edited by

                    @beremonavabi

                    Does it now work ?

                    You both shouldn't need to have it listening on the WAN interface.

                    Andy

                    1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                    beremonavabiB 1 Reply Last reply Reply Quote 0
                    • brunovicB
                      brunovic @johnpoz
                      last edited by

                      @johnpoz so it looks like my outbound NAT is manually configured. How will this prevent NTP from syncing?

                      0_1528993260522_Capture08.JPG

                      brunovicB 1 Reply Last reply Reply Quote 0
                      • beremonavabiB
                        beremonavabi @NogBadTheBad
                        last edited by

                        @nogbadthebad said in Time is not syncing:

                        @beremonavabi

                        Does it now work ?

                        You both shouldn't need to have it listening on the WAN interface.

                        NTP will ONLY run on my SG-4860 if WAN is selected to listen to (the gory details of everything I've tried are in the thread I referenced, above). I agree that the WAN shouldn't be necessary. But, for no reason I can come up with, it turns out to be necessary in my case.

                        Looking over some of brunovic's other posts, it looks like he's using a VPN. I am, too. It's possible that's a relationship, but I just don't see why using a VPN might interfere with NTP.

                        SG-4860, pfSense 2.4.5-RELEASE-p1 (amd64)

                        brunovicB NogBadTheBadN johnpozJ 3 Replies Last reply Reply Quote 0
                        • brunovicB
                          brunovic @beremonavabi
                          last edited by

                          @beremonavabi I use a VPN for remote access into my network but not for outbound traffic. Is that how you are using it?

                          beremonavabiB 1 Reply Last reply Reply Quote 0
                          • NogBadTheBadN
                            NogBadTheBad @beremonavabi
                            last edited by NogBadTheBad

                            @beremonavabi said in Time is not syncing:

                            @nogbadthebad said in Time is not syncing:

                            @beremonavabi

                            Does it now work ?

                            You both shouldn't need to have it listening on the WAN interface.

                            NTP will ONLY run on my SG-4860 if WAN is selected to listen to (the gory details of everything I've tried are in the thread I referenced, above). I agree that the WAN shouldn't be necessary. But, for no reason I can come up with, it turns out to be necessary in my case.

                            Looking over some of brunovic's other posts, it looks like he's using a VPN. I am, too. It's possible that's a relationship, but I just don't see why using a VPN might interfere with NTP.

                            I run a IKEv2 IPsec VPN ( inbound ) too I've got Automatic outbound NAT rule generation set.

                            Andy

                            1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                            1 Reply Last reply Reply Quote 0
                            • beremonavabiB
                              beremonavabi @brunovic
                              last edited by

                              @brunovic I've got OpenVPN clients running on my pfSense box to my VPN provider (AirVPN). I've also got a server running on it so our phones can use the VPN.

                              SG-4860, pfSense 2.4.5-RELEASE-p1 (amd64)

                              brunovicB 1 Reply Last reply Reply Quote 0
                              • brunovicB
                                brunovic @beremonavabi
                                last edited by

                                @beremonavabi ah no I am not using the client on my pfsense just the server.

                                beremonavabiB 1 Reply Last reply Reply Quote 0
                                • beremonavabiB
                                  beremonavabi @brunovic
                                  last edited by

                                  @brunovic said in Time is not syncing:

                                  @beremonavabi ah no I am not using the client on my pfsense just the server.

                                  Well, an OpenVPN server commonality might be a start. Mine is listening on port 443. My firewall rules on the WAN look like:

                                  0_1528994663634_20180604 -- Firewall Rules WAN.PNG

                                  Like you, my NAT rules are Manual. Outside of your specific ports, mine look similar:

                                  0_1528994721603_20180610 -- pfSense Firewall NAT Outbound.PNG

                                  For DNS, I’m using DNS Resolver in NON-Forwarding mode. It’s active for all my local LAN-type interfaces (not WAN). Though, since I've checked with NTP using actual IP addresses instead of pool names (as you did), I can't see how this could be DNS related.

                                  SG-4860, pfSense 2.4.5-RELEASE-p1 (amd64)

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator @beremonavabi
                                    last edited by

                                    @beremonavabi said in Time is not syncing:

                                    NTP will ONLY run on my SG-4860 if WAN is selected to listen

                                    I have sg4860, I run both vpn servers on multiple instances 443 tcp, 1194 udp and also a vpn client connection to a vps out on the net running openvpn-as..

                                    But I am NOT pulling routes from that connection and only policy route out to that vpn if need a client to take that path.. And I am NOT listening on the wan port and have zero issues with ntp talking to outbound ntp per previous screen shots.

                                    So you clearly have something messed up in your configuration causing this problem there is zero reason that ntp should have to listen on wan to talk to ntp servers on the internet.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    beremonavabiB 1 Reply Last reply Reply Quote 0
                                    • beremonavabiB
                                      beremonavabi @johnpoz
                                      last edited by beremonavabi

                                      @johnpoz said in Time is not syncing:

                                      @beremonavabi said in Time is not syncing:

                                      NTP will ONLY run on my SG-4860 if WAN is selected to listen

                                      I have sg4860, I run both vpn servers on multiple instances 443 tcp, 1194 udp and also a vpn client connection to a vps out on the net running openvpn-as..

                                      But I am NOT pulling routes from that connection and only policy route out to that vpn if need a client to take that path.. And I am NOT listening on the wan port and have zero issues with ntp talking to outbound ntp per previous screen shots.

                                      So you clearly have something messed up in your configuration causing this problem there is zero reason that ntp should have to listen on wan to talk to ntp servers on the internet.

                                      I'm also not pulling routes. I'm mostly clueless about this, but my routes look fine, to me:

                                      IPv4 Routes
                                      Destination	Gateway	Flags	Use	Mtu	Netif	Expire
                                      0.0.0.0/1	10.4.0.1	UGS	16952	1500	ovpnc1	
                                      default		[my WAN IP]	UGS	34	1500	igb1	
                                      10.4.0.0/16	10.4.0.1	UGS	0	1500	ovpnc1	
                                      10.4.0.1	link#12	UH	371622	1500	ovpnc1	
                                      10.4.0.14	link#12	UHS	0	16384	lo0	
                                      10.8.0.0/16	10.8.0.1	UGS	0	1500	ovpnc2	
                                      10.8.0.1	link#13	UH	371535	1500	ovpnc2	
                                      10.8.0.27	link#13	UHS	0	16384	lo0	
                                      [my WAN net]/24	link#2	U	371654	1500	igb1	
                                      [my WAN IP]	link#2	UHS	0	16384	lo0	
                                      127.0.0.1	link#7	UH	6821	16384	lo0	
                                      128.0.0.0/1	10.4.0.1	UGS	84534	1500	ovpnc1	
                                      192.168.1.0/24	link#1	U	0	1500	igb0	
                                      192.168.1.1	link#1	UHS	0	16384	lo0	
                                      192.168.10.0/24	link#3	U	0	1500	igb2	
                                      192.168.10.1	link#3	UHS	0	16384	lo0	
                                      192.168.20.0/24	link#4	U	10946342	1500	igb3	
                                      192.168.20.1	link#4	UHS	0	16384	lo0	
                                      192.168.30.0/24	link#5	U	464495	1500	igb4	
                                      192.168.30.1	link#5	UHS	0	16384	lo0	
                                      192.168.40.0/24	link#6	U	0	1500	igb5	
                                      192.168.40.1	link#6	UHS	0	16384	lo0	
                                      192.168.200.0/24	192.168.200.2	UGS	333989	1500	ovpns3	
                                      192.168.200.1	link#11	UHS	743340	16384	lo0	
                                      192.168.200.2	link#11	UH	33730	1500	ovpns3	
                                      [VPN address]/32	[my WAN IP]	UGS	456678	1500	igb1	
                                      [VPN address]/32	[my WAN IP]	UGS	5024988	1500	igb1	
                                      
                                      

                                      EDIT: Since only a handful of us have had this issue, I agree that I must have something messed up in my configuration. But I have no idea what it is. And, since nothing in my logs leaps out at me as being a problem, I don't even know where to look. I've pretty much given up on this and am just living with NTP on WAN.

                                      SG-4860, pfSense 2.4.5-RELEASE-p1 (amd64)

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by

                                        @beremonavabi said in Time is not syncing:

                                        0.0.0.0/1 10.4.0.1 UGS 16952 1500 ovpnc1

                                        No your pulling routes if you have something like that..

                                        You blocked routes from your client config? See how have only my wan default route and only routes for my client connection are the network its connected too.0_1529004862429_notpull.png

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        beremonavabiB 1 Reply Last reply Reply Quote 0
                                        • beremonavabiB
                                          beremonavabi @johnpoz
                                          last edited by

                                          @johnpoz I've got the same "Don't pull routes" box checked in my VPN clients. The 0.0.0.0/1 (and the 128.0.0.0/1) routes are added with the "redirect-gateway def1" Custom Option I'm using. That redirects all my traffic through the VPN (whereas you are policy routing specific clients), but leaves the default route untouched so the firewall, itself, can get through the WAN:

                                          https://forum.netgate.com/topic/115760/firewall-traffic-needs-redirect-gateway-def1-to-route-thru-vpn

                                          That being said, I had also been wondering if that could be causing the issue. But, since the OP of this thread isn't using a VPN client on pfSense, he shouldn't have those routes set. So, if that were the problem, he shouldn't be seeing it. Also, from my other thread I referenced earlier, I'm pretty sure that's what I tried to work around with a specific Outgoing NAT rule to allow UDP 123 traffic to go through the WAN:

                                          0_1529006304514_20180610 -- pfSense NTP Fix Question.PNG

                                          That didn't work. So, obviously it didn't do what I thought it might.

                                          Still, that's all on the routing side. I still don't understand why having NTP listen on the WAN would allow this to work. AFAIK, the NTP client on pfSense sends out traffic asking for the time and gets a response. There shouldn't be anything legitimate arriving unsolicited from the internet. So, the incoming NTP traffic ought to get right through the firewall since it's in response to a legitimate request.

                                          Do you have any blocking rules on your WAN to block incoming private/bogon networks? Or, do you just let the default "block everything" behavior in pfSense handle that? Could the NTP traffic from my setup be somehow avoiding NAT, going out with my private address on it, and getting blocked on the way back in by my rules?

                                          SG-4860, pfSense 2.4.5-RELEASE-p1 (amd64)

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by johnpoz

                                            @beremonavabi said in Time is not syncing:

                                            Custom Option I’m using.

                                            Same problem then... Why would you be doing that.. Turn that off - does your ntp start working now... Its quite possible your vpn is just blocking ntp. Sniff on your vpn interface do you see the ntp queries go out?

                                            Argghhh I wish people would stop jumping into threads that have NOTHING to do with their problem or their setup is completely different..

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            beremonavabiB 1 Reply Last reply Reply Quote 1
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.