Time is not syncing
-
Andy
1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22
-
@johnpoz so it looks like my outbound NAT is manually configured. How will this prevent NTP from syncing?
-
@nogbadthebad said in Time is not syncing:
Does it now work ?
You both shouldn't need to have it listening on the WAN interface.
NTP will ONLY run on my SG-4860 if WAN is selected to listen to (the gory details of everything I've tried are in the thread I referenced, above). I agree that the WAN shouldn't be necessary. But, for no reason I can come up with, it turns out to be necessary in my case.
Looking over some of brunovic's other posts, it looks like he's using a VPN. I am, too. It's possible that's a relationship, but I just don't see why using a VPN might interfere with NTP.
SG-4860, pfSense 2.4.5-RELEASE-p1 (amd64)
-
@beremonavabi I use a VPN for remote access into my network but not for outbound traffic. Is that how you are using it?
-
@beremonavabi said in Time is not syncing:
@nogbadthebad said in Time is not syncing:
Does it now work ?
You both shouldn't need to have it listening on the WAN interface.
NTP will ONLY run on my SG-4860 if WAN is selected to listen to (the gory details of everything I've tried are in the thread I referenced, above). I agree that the WAN shouldn't be necessary. But, for no reason I can come up with, it turns out to be necessary in my case.
Looking over some of brunovic's other posts, it looks like he's using a VPN. I am, too. It's possible that's a relationship, but I just don't see why using a VPN might interfere with NTP.
I run a IKEv2 IPsec VPN ( inbound ) too I've got Automatic outbound NAT rule generation set.
-
@brunovic I've got OpenVPN clients running on my pfSense box to my VPN provider (AirVPN). I've also got a server running on it so our phones can use the VPN.
-
@beremonavabi ah no I am not using the client on my pfsense just the server.
-
@brunovic said in Time is not syncing:
@beremonavabi ah no I am not using the client on my pfsense just the server.
Well, an OpenVPN server commonality might be a start. Mine is listening on port 443. My firewall rules on the WAN look like:
Like you, my NAT rules are Manual. Outside of your specific ports, mine look similar:
For DNS, I’m using DNS Resolver in NON-Forwarding mode. It’s active for all my local LAN-type interfaces (not WAN). Though, since I've checked with NTP using actual IP addresses instead of pool names (as you did), I can't see how this could be DNS related.
-
@beremonavabi said in Time is not syncing:
NTP will ONLY run on my SG-4860 if WAN is selected to listen
I have sg4860, I run both vpn servers on multiple instances 443 tcp, 1194 udp and also a vpn client connection to a vps out on the net running openvpn-as..
But I am NOT pulling routes from that connection and only policy route out to that vpn if need a client to take that path.. And I am NOT listening on the wan port and have zero issues with ntp talking to outbound ntp per previous screen shots.
So you clearly have something messed up in your configuration causing this problem there is zero reason that ntp should have to listen on wan to talk to ntp servers on the internet.
-
@johnpoz said in Time is not syncing:
@beremonavabi said in Time is not syncing:
NTP will ONLY run on my SG-4860 if WAN is selected to listen
I have sg4860, I run both vpn servers on multiple instances 443 tcp, 1194 udp and also a vpn client connection to a vps out on the net running openvpn-as..
But I am NOT pulling routes from that connection and only policy route out to that vpn if need a client to take that path.. And I am NOT listening on the wan port and have zero issues with ntp talking to outbound ntp per previous screen shots.
So you clearly have something messed up in your configuration causing this problem there is zero reason that ntp should have to listen on wan to talk to ntp servers on the internet.
I'm also not pulling routes. I'm mostly clueless about this, but my routes look fine, to me:
IPv4 Routes Destination Gateway Flags Use Mtu Netif Expire 0.0.0.0/1 10.4.0.1 UGS 16952 1500 ovpnc1 default [my WAN IP] UGS 34 1500 igb1 10.4.0.0/16 10.4.0.1 UGS 0 1500 ovpnc1 10.4.0.1 link#12 UH 371622 1500 ovpnc1 10.4.0.14 link#12 UHS 0 16384 lo0 10.8.0.0/16 10.8.0.1 UGS 0 1500 ovpnc2 10.8.0.1 link#13 UH 371535 1500 ovpnc2 10.8.0.27 link#13 UHS 0 16384 lo0 [my WAN net]/24 link#2 U 371654 1500 igb1 [my WAN IP] link#2 UHS 0 16384 lo0 127.0.0.1 link#7 UH 6821 16384 lo0 128.0.0.0/1 10.4.0.1 UGS 84534 1500 ovpnc1 192.168.1.0/24 link#1 U 0 1500 igb0 192.168.1.1 link#1 UHS 0 16384 lo0 192.168.10.0/24 link#3 U 0 1500 igb2 192.168.10.1 link#3 UHS 0 16384 lo0 192.168.20.0/24 link#4 U 10946342 1500 igb3 192.168.20.1 link#4 UHS 0 16384 lo0 192.168.30.0/24 link#5 U 464495 1500 igb4 192.168.30.1 link#5 UHS 0 16384 lo0 192.168.40.0/24 link#6 U 0 1500 igb5 192.168.40.1 link#6 UHS 0 16384 lo0 192.168.200.0/24 192.168.200.2 UGS 333989 1500 ovpns3 192.168.200.1 link#11 UHS 743340 16384 lo0 192.168.200.2 link#11 UH 33730 1500 ovpns3 [VPN address]/32 [my WAN IP] UGS 456678 1500 igb1 [VPN address]/32 [my WAN IP] UGS 5024988 1500 igb1EDIT: Since only a handful of us have had this issue, I agree that I must have something messed up in my configuration. But I have no idea what it is. And, since nothing in my logs leaps out at me as being a problem, I don't even know where to look. I've pretty much given up on this and am just living with NTP on WAN.
-
@beremonavabi said in Time is not syncing:
0.0.0.0/1 10.4.0.1 UGS 16952 1500 ovpnc1
No your pulling routes if you have something like that..
You blocked routes from your client config? See how have only my wan default route and only routes for my client connection are the network its connected too.
-
@johnpoz I've got the same "Don't pull routes" box checked in my VPN clients. The 0.0.0.0/1 (and the 128.0.0.0/1) routes are added with the "redirect-gateway def1" Custom Option I'm using. That redirects all my traffic through the VPN (whereas you are policy routing specific clients), but leaves the default route untouched so the firewall, itself, can get through the WAN:
https://forum.netgate.com/topic/115760/firewall-traffic-needs-redirect-gateway-def1-to-route-thru-vpn
That being said, I had also been wondering if that could be causing the issue. But, since the OP of this thread isn't using a VPN client on pfSense, he shouldn't have those routes set. So, if that were the problem, he shouldn't be seeing it. Also, from my other thread I referenced earlier, I'm pretty sure that's what I tried to work around with a specific Outgoing NAT rule to allow UDP 123 traffic to go through the WAN:
That didn't work. So, obviously it didn't do what I thought it might.
Still, that's all on the routing side. I still don't understand why having NTP listen on the WAN would allow this to work. AFAIK, the NTP client on pfSense sends out traffic asking for the time and gets a response. There shouldn't be anything legitimate arriving unsolicited from the internet. So, the incoming NTP traffic ought to get right through the firewall since it's in response to a legitimate request.
Do you have any blocking rules on your WAN to block incoming private/bogon networks? Or, do you just let the default "block everything" behavior in pfSense handle that? Could the NTP traffic from my setup be somehow avoiding NAT, going out with my private address on it, and getting blocked on the way back in by my rules?
-
@beremonavabi said in Time is not syncing:
Custom Option I’m using.
Same problem then... Why would you be doing that.. Turn that off - does your ntp start working now... Its quite possible your vpn is just blocking ntp. Sniff on your vpn interface do you see the ntp queries go out?
Argghhh I wish people would stop jumping into threads that have NOTHING to do with their problem or their setup is completely different..
-
@johnpoz said in Time is not syncing:
Argghhh I wish people would stop jumping into threads that have NOTHING to do with their problem or their setup is completely different..
What are you talking about? I "jumped" into this thread and gave the OP the solution he needed to get NTP working (select the WAN in Services > NTP). I then noted he was using VPN, as was I. That's a point in common. I was trying to explore that as possibly relating to this issue. In what way did I jump in with something not related to the problem?
But, I guess, just forget it.
-
@beremonavabi said in Time is not syncing:
(select the WAN in Services > NTP)
That is NOT a solution... That is a work around for some other misconfig..
Did you do what I suggested and remove the 0.0.0.0 route you have and see if works then not picking wan.
-
So to follow up on my issue which may be different from beremonavabi's. When I have the NTP interfaces set to internal interfaces I am unable to sync with NTP servers however when I ping I can get to them just fine. But when I selected WAN interface for NTP I am able to sync with the NTP servers. What could be causing that?
-
Also under NTP what does selecting those interfaces even mean? How does it "listen" on those interfaces for NTP? Does it just mean that it sources the interface IPs? That part right there really confuses me.
-
NTP is 100% UDP and with UDP your application (in this case the NTP service) is responsible for both sending out the queries and listening for replies. This is completely unlike compared to TCP where TCP does all the heavy lifting for you with setting up the connection and dealing with the return traffic. The consquence of this is that any application using a UDP based protocol has to listen on a socket to do anything, even if it's just a client querying other servers.
-
This post is deleted! -
@kpa said in Time is not syncing:
NTP is 100% UDP and with UDP your application (in this case the NTP service) is responsible for both sending out the queries and listening for replies. This is completely unlike compared to TCP where TCP does all the heavy lifting for you with setting up the connection and dealing with the return traffic. The consquence of this is that any application using a UDP based protocol has to listen on a socket to do anything, even if it's just a client querying other servers.
Okay. That doesn't answer my question though. My questions are:
- Why does it sync on WAN but not on any of the internal interfaces
- What does it mean by it is "listening" on those interfaces. I need to know from a routing perspective. I've done a ping sourcing those interfaces and pings from LAN, GUEST, etc come back with 0% packet loss. So if what you are telling me is true IF NTP is listening on though interfaces then UDP should not have a problem IF ICMP is fine.
