• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Time is not syncing

Scheduled Pinned Locked Moved General pfSense Questions
62 Posts 6 Posters 15.6k Views 7 Watching
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • B Offline
    brunovic @kpa
    last edited by brunovic Jun 19, 2018, 4:34 PM Jun 19, 2018, 4:32 PM

    @kpa said in Time is not syncing:

    NTP is 100% UDP and with UDP your application (in this case the NTP service) is responsible for both sending out the queries and listening for replies. This is completely unlike compared to TCP where TCP does all the heavy lifting for you with setting up the connection and dealing with the return traffic. The consquence of this is that any application using a UDP based protocol has to listen on a socket to do anything, even if it's just a client querying other servers.

    Okay. That doesn't answer my question though. My questions are:

    1. Why does it sync on WAN but not on any of the internal interfaces
    2. What does it mean by it is "listening" on those interfaces. I need to know from a routing perspective. I've done a ping sourcing those interfaces and pings from LAN, GUEST, etc come back with 0% packet loss. So if what you are telling me is true IF NTP is listening on though interfaces then UDP should not have a problem IF ICMP is fine.
    1 Reply Last reply Reply Quote 0
    • K Offline
      kpa
      last edited by kpa Jun 19, 2018, 4:55 PM Jun 19, 2018, 4:40 PM

      1. Post your outbound NAT configuration, if WAN is deselected from the interfaces the NTP service might be trying to bind to another interface but the outgoing connections fail because of faulty outbound NAT settings.

      2. It means literally what it says, listening for incoming data packets on the said interface. UDP is connectionless and stateless, an application that uses the UDP socket sends out a data packet (or multiples depending on the protocol) and then stops in listening mode to wait for the replies to the sent packets. Once those are received the data is processed and the loop starts again by either sending out more data or staying in listening mode for more incoming packets.

      B 1 Reply Last reply Jun 19, 2018, 6:01 PM Reply Quote 0
      • B Offline
        brunovic @brunovic
        last edited by Jun 19, 2018, 4:56 PM

        @brunovic said in Time is not syncing:

        @johnpoz so it looks like my outbound NAT is manually configured. How will this prevent NTP from syncing?

        0_1528993260522_Capture08.JPG

        This is what you are looking for right?

        1 Reply Last reply Reply Quote 0
        • B Offline
          brunovic @kpa
          last edited by Jun 19, 2018, 6:01 PM

          @kpa if that is the case then why would it be listening to NTP packets on the LAN and not the WAN? That server is not on my internal network.

          N 1 Reply Last reply Jun 19, 2018, 10:33 PM Reply Quote 0
          • N Offline
            NogBadTheBad @brunovic
            last edited by Jun 19, 2018, 10:33 PM

            @brunovic

            Your router can provide ntp to clients on your lan, that’s why it listens on the lan interface.

            Have a look at the dhcp settings for your lan subnet.

            Andy

            1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

            1 Reply Last reply Reply Quote 0
            • J Offline
              johnpoz LAYER 8 Global Moderator
              last edited by Jun 20, 2018, 8:31 AM

              Why do you have it in manual mode if all you doing is what automatic would be doing?

              Where is your nat for vpn connections, your tunnel network would need to be natted? Try changing it to automatic.. You sure and the hell should not have to listen on wan to query a time server.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 25.07 | Lab VMs 2.8, 25.07

              B 1 Reply Last reply Jun 20, 2018, 11:37 AM Reply Quote 0
              • B Offline
                brunovic @johnpoz
                last edited by Jun 20, 2018, 11:37 AM

                @johnpoz said in Time is not syncing:

                Why do you have it in manual mode if all you doing is what automatic would be doing?

                Where is your nat for vpn connections, your tunnel network would need to be natted? Try changing it to automatic.. You sure and the hell should not have to listen on wan to query a time server.

                There is a reason to it. I can't remember but something was not working correctly in automatic mode.

                J 1 Reply Last reply Jun 20, 2018, 12:55 PM Reply Quote 0
                • J Offline
                  johnpoz LAYER 8 Global Moderator
                  last edited by Jun 20, 2018, 12:37 PM

                  Like what? Put it back.. And delete all your manual rules. You can always put it back to manual if this whatever it is comes back.. But if there is something that is not working in automatic mode that should be brought up so we can fix it, so other users using automatic don't have whatever this is issue is you think you were having.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 25.07 | Lab VMs 2.8, 25.07

                  B 1 Reply Last reply Jun 20, 2018, 3:48 PM Reply Quote 0
                  • J Offline
                    jimp Rebel Alliance Developer Netgate @brunovic
                    last edited by Jun 20, 2018, 12:55 PM

                    @brunovic said in Time is not syncing:

                    There is a reason to it. I can't remember but something was not working correctly in automatic mode.

                    This makes me think you have some other misconfiguration as the root cause here. If your WAN is static, make sure you have a gateway set on Interfaces > WAN. And also check Interfaces > LAN and make sure you do not have a gateway set there. Same for your other local interface(s) like Guest.

                    Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                    Need help fast? Netgate Global Support!

                    Do not Chat/PM for help!

                    B 1 Reply Last reply Jun 20, 2018, 3:42 PM Reply Quote 0
                    • B Offline
                      brunovic @jimp
                      last edited by Jun 20, 2018, 3:42 PM

                      @jimp said in Time is not syncing:

                      @brunovic said in Time is not syncing:

                      There is a reason to it. I can't remember but something was not working correctly in automatic mode.

                      This makes me think you have some other misconfiguration as the root cause here. If your WAN is static, make sure you have a gateway set on Interfaces > WAN. And also check Interfaces > LAN and make sure you do not have a gateway set there. Same for your other local interface(s) like Guest.

                      If you see my route print screen above the only quad zeros out are on the WAN interface.

                      J 1 Reply Last reply Jun 20, 2018, 3:49 PM Reply Quote 0
                      • B Offline
                        brunovic @johnpoz
                        last edited by Jun 20, 2018, 3:48 PM

                        @johnpoz said in Time is not syncing:

                        Like what? Put it back.. And delete all your manual rules. You can always put it back to manual if this whatever it is comes back.. But if there is something that is not working in automatic mode that should be brought up so we can fix it, so other users using automatic don't have whatever this is issue is you think you were having.

                        I'll keep it at manual. I am VPN into my network. If these manual routes were for that the last thing I want to to hose my own connection. All I need to know is what outbound NAT rule should I be seeing in order for NTP to work without having to select the WAN interface.

                        1 Reply Last reply Reply Quote 0
                        • J Offline
                          jimp Rebel Alliance Developer Netgate @brunovic
                          last edited by Jun 20, 2018, 3:49 PM

                          @brunovic said in Time is not syncing:

                          If you see my route print screen above the only quad zeros out are on the WAN interface.

                          That has nothing at all to do with what I said or why I asked. :-)

                          Read my message again and check the settings I mentioned.

                          Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                          Need help fast? Netgate Global Support!

                          Do not Chat/PM for help!

                          B 1 Reply Last reply Jun 20, 2018, 3:50 PM Reply Quote 0
                          • B Offline
                            brunovic @jimp
                            last edited by Jun 20, 2018, 3:50 PM

                            @jimp said in Time is not syncing:

                            @brunovic said in Time is not syncing:

                            If you see my route print screen above the only quad zeros out are on the WAN interface.

                            That has nothing at all to do with what I said or why I asked. :-)

                            Read my message again and check the settings I mentioned.

                            What does the gateway setting do?

                            J 1 Reply Last reply Jun 20, 2018, 3:57 PM Reply Quote 0
                            • J Offline
                              jimp Rebel Alliance Developer Netgate @brunovic
                              last edited by Jun 20, 2018, 3:57 PM

                              @brunovic said in Time is not syncing:

                              What does the gateway setting do?

                              It controls whether or not pfSense treats an interface like a "WAN" for NAT and other purposes. If you have no gateway on WAN, or a gateway set on LAN or other internal interfaces, it will confuse the code that tries to setup automatic NAT and other functions.

                              WANs must have a gateway selected in their interface settings (statics anyhow, dynamics will get this automatically), LANs must not have a gateway set on the interface settings.

                              Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                              Need help fast? Netgate Global Support!

                              Do not Chat/PM for help!

                              B 1 Reply Last reply Jun 20, 2018, 4:04 PM Reply Quote 0
                              • B Offline
                                brunovic
                                last edited by Jun 20, 2018, 4:02 PM

                                Also if it helps one of the things I had to do was create rules that seperated VLAN traffic from one another. This is a bit reverse from Cisco where you have to assign VTI and create route statements before any VLAN can start talking with one another. However for pfsense the moment you create a VLAN everything is automatically routed between VLANs. I do not like that at all. All I want are the VLANs to be independant from each other and for them to get out to the internet on their own. If I want to route traffic between VLANs I should be able to opt-in not opt-out. As a result I ended making some janky solution where I created alias with all other VLAN networks but it's own and told it to go anywhere but those networks.

                                0_1529510532465_Capture09.JPG
                                0_1529510540718_Capture10.JPG

                                J 1 Reply Last reply Jun 20, 2018, 4:04 PM Reply Quote 0
                                • J Offline
                                  jimp Rebel Alliance Developer Netgate @brunovic
                                  last edited by Jun 20, 2018, 4:04 PM

                                  @brunovic said in Time is not syncing:

                                  Also if it helps one of the things I had to do was create rules that seperated VLAN traffic from one another. This is a bit reverse from Cisco where you have to assign VTI and create route statements before any VLAN can start talking with one another. However for pfsense the moment you create a VLAN everything is automatically routed between VLANs. I do not like that at all. All I want are the VLANs to be independant from each other and for them to get out to the internet on their own. If I want to route traffic between VLANs I should be able to opt-in not opt-out. As a result I ended making some janky solution where I created alias with all other VLAN networks but it's own and told it to go anywhere but those networks.

                                  Routing happens automatically, rules do not. They were allowed to do that because your rules allowed it. If you setup your rules properly, that won't happen. That's not related to this thread, however.

                                  Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                                  Need help fast? Netgate Global Support!

                                  Do not Chat/PM for help!

                                  1 Reply Last reply Reply Quote 0
                                  • B Offline
                                    brunovic @jimp
                                    last edited by Jun 20, 2018, 4:04 PM

                                    @jimp said in Time is not syncing:

                                    @brunovic said in Time is not syncing:

                                    What does the gateway setting do?

                                    It controls whether or not pfSense treats an interface like a "WAN" for NAT and other purposes. If you have no gateway on WAN, or a gateway set on LAN or other internal interfaces, it will confuse the code that tries to setup automatic NAT and other functions.

                                    WANs must have a gateway selected in their interface settings (statics anyhow, dynamics will get this automatically), LANs must not have a gateway set on the interface settings.

                                    Anyways to answer your question there is no setting under the WAN interface to designate it as the gateway. And all other interface are not designated the gateway.

                                    1 Reply Last reply Reply Quote 0
                                    • B Offline
                                      brunovic
                                      last edited by Jun 20, 2018, 4:17 PM

                                      I feel like no one is talking to me like a network engineer. I never had this much difficulty trying to configure a Cisco router, firewall or switch. I may have screwed something up and I think the problem here is you guys are trying to troubleshoot my problem. I am pretty proficient enough to troubleshoot it myself. But the one answer I have not been getting it HOW exactly is the NTP communication routing? Is the NTP server sourcing the LAN interface going out the WAN or is it sending the NTP out the LAN interface. That is what is confusing me about the "interface section" under NTP Server Settings. If it is the latter then no wonder it isn't syncing because there are no NTP servers on my LAN network however IF it is the former. I have already done a ping test to the NTP server SOURCING the LAN interfaces and I got 100% replies. IF this is a NAT issued then pings would fail.

                                      1 Reply Last reply Reply Quote 0
                                      • J Offline
                                        jimp Rebel Alliance Developer Netgate
                                        last edited by jimp Jun 20, 2018, 4:29 PM Jun 20, 2018, 4:29 PM

                                        @brunovic said in Time is not syncing:

                                        I feel like no one is talking to me like a network engineer. I never had this much difficulty trying to configure a Cisco router, firewall or switch. I may have screwed something up and I think the problem here is you guys are trying to troubleshoot my problem.

                                        This isn't Cisco. And if you don't want help, I'll gladly not give it. You have precisely the kind of attitude found on a person most likely to overlook something because they think they know better, and that is why it's most important to start with the basics and work up.

                                        NTP is UDP. UDP will follow the routing table. The interface binding controls what it binds to locally, but it still respects the routing table to find the interface it will exit from. If you bind to LAN, it will source the packets using the LAN IP address but the traffic still exits the firewall through whatever route gets it to the destination (e.g. the default route). Sourcing from the LAN and exiting WAN also means that it gets NAT applied.

                                        On my test systems here, I can select LAN only and it still can synchronize time just fine, with otherwise stock NTP settings.

                                        Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                                        Need help fast? Netgate Global Support!

                                        Do not Chat/PM for help!

                                        B 1 Reply Last reply Jun 20, 2018, 4:40 PM Reply Quote 0
                                        • B Offline
                                          brunovic @jimp
                                          last edited by brunovic Jun 20, 2018, 4:42 PM Jun 20, 2018, 4:40 PM

                                          @jimp said in Time is not syncing:

                                          @brunovic said in Time is not syncing:

                                          I feel like no one is talking to me like a network engineer. I never had this much difficulty trying to configure a Cisco router, firewall or switch. I may have screwed something up and I think the problem here is you guys are trying to troubleshoot my problem.

                                          This isn't Cisco. And if you don't want help, I'll gladly not give it. You have precisely the kind of attitude found on a person most likely to overlook something because they think they know better, and that is why it's most important to start with the basics and work up.

                                          NTP is UDP. UDP will follow the routing table. The interface binding controls what it binds to locally, but it still respects the routing table to find the interface it will exit from. If you bind to LAN, it will source the packets using the LAN IP address but the traffic still exits the firewall through whatever route gets it to the destination (e.g. the default route). Sourcing from the LAN and exiting WAN also means that it gets NAT applied.

                                          On my test systems here, I can select LAN only and it still can synchronize time just fine, with otherwise stock NTP settings.

                                          I understand this is not Cisco. What I am trying to do is to get you to understand that I understand the networking basics and from a network standpoint everything looks good. Now unless there is something that has been done without my knowledge THAT is what I need to know. But I would not set the internal interfaces to be the gateway because I know that will break network traffic. I've already confirmed this with you when I checked the LAN interface. Also IF this is a NAT issue the whole point of Network Address Translation is for internal class c addresses to source the WAN interface IP for external traffic. As I've demonstrated when sourcing the LAN interface IP I am able to ping the NTP server. If NAT was not working properly I should not be able to ping the NTP server from the LAN interface. So this leaves the question IF NAT is working properly and I am able to ping the NTP servers then WHY am I not able to sync with the NTP server when anything but the WAN interface is selected under the NTP Settings.

                                          0_1529512971315_Capture11.JPG

                                          1 Reply Last reply Reply Quote 0
                                          52 out of 62
                                          • First post
                                            52/62
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received