Time is not syncing
-
@johnpoz said in Time is not syncing:
Like what? Put it back.. And delete all your manual rules. You can always put it back to manual if this whatever it is comes back.. But if there is something that is not working in automatic mode that should be brought up so we can fix it, so other users using automatic don't have whatever this is issue is you think you were having.
I'll keep it at manual. I am VPN into my network. If these manual routes were for that the last thing I want to to hose my own connection. All I need to know is what outbound NAT rule should I be seeing in order for NTP to work without having to select the WAN interface.
-
@brunovic said in Time is not syncing:
If you see my route print screen above the only quad zeros out are on the WAN interface.
That has nothing at all to do with what I said or why I asked. :-)
Read my message again and check the settings I mentioned.
Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!
Need help fast? Netgate Global Support!
Do not Chat/PM for help!
-
@jimp said in Time is not syncing:
@brunovic said in Time is not syncing:
If you see my route print screen above the only quad zeros out are on the WAN interface.
That has nothing at all to do with what I said or why I asked. :-)
Read my message again and check the settings I mentioned.
What does the gateway setting do?
-
@brunovic said in Time is not syncing:
What does the gateway setting do?
It controls whether or not pfSense treats an interface like a "WAN" for NAT and other purposes. If you have no gateway on WAN, or a gateway set on LAN or other internal interfaces, it will confuse the code that tries to setup automatic NAT and other functions.
WANs must have a gateway selected in their interface settings (statics anyhow, dynamics will get this automatically), LANs must not have a gateway set on the interface settings.
Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!
Need help fast? Netgate Global Support!
Do not Chat/PM for help!
-
Also if it helps one of the things I had to do was create rules that seperated VLAN traffic from one another. This is a bit reverse from Cisco where you have to assign VTI and create route statements before any VLAN can start talking with one another. However for pfsense the moment you create a VLAN everything is automatically routed between VLANs. I do not like that at all. All I want are the VLANs to be independant from each other and for them to get out to the internet on their own. If I want to route traffic between VLANs I should be able to opt-in not opt-out. As a result I ended making some janky solution where I created alias with all other VLAN networks but it's own and told it to go anywhere but those networks.
-
@brunovic said in Time is not syncing:
Also if it helps one of the things I had to do was create rules that seperated VLAN traffic from one another. This is a bit reverse from Cisco where you have to assign VTI and create route statements before any VLAN can start talking with one another. However for pfsense the moment you create a VLAN everything is automatically routed between VLANs. I do not like that at all. All I want are the VLANs to be independant from each other and for them to get out to the internet on their own. If I want to route traffic between VLANs I should be able to opt-in not opt-out. As a result I ended making some janky solution where I created alias with all other VLAN networks but it's own and told it to go anywhere but those networks.
Routing happens automatically, rules do not. They were allowed to do that because your rules allowed it. If you setup your rules properly, that won't happen. That's not related to this thread, however.
-
@jimp said in Time is not syncing:
@brunovic said in Time is not syncing:
What does the gateway setting do?
It controls whether or not pfSense treats an interface like a "WAN" for NAT and other purposes. If you have no gateway on WAN, or a gateway set on LAN or other internal interfaces, it will confuse the code that tries to setup automatic NAT and other functions.
WANs must have a gateway selected in their interface settings (statics anyhow, dynamics will get this automatically), LANs must not have a gateway set on the interface settings.
Anyways to answer your question there is no setting under the WAN interface to designate it as the gateway. And all other interface are not designated the gateway.
-
I feel like no one is talking to me like a network engineer. I never had this much difficulty trying to configure a Cisco router, firewall or switch. I may have screwed something up and I think the problem here is you guys are trying to troubleshoot my problem. I am pretty proficient enough to troubleshoot it myself. But the one answer I have not been getting it HOW exactly is the NTP communication routing? Is the NTP server sourcing the LAN interface going out the WAN or is it sending the NTP out the LAN interface. That is what is confusing me about the "interface section" under NTP Server Settings. If it is the latter then no wonder it isn't syncing because there are no NTP servers on my LAN network however IF it is the former. I have already done a ping test to the NTP server SOURCING the LAN interfaces and I got 100% replies. IF this is a NAT issued then pings would fail.
-
@brunovic said in Time is not syncing:
I feel like no one is talking to me like a network engineer. I never had this much difficulty trying to configure a Cisco router, firewall or switch. I may have screwed something up and I think the problem here is you guys are trying to troubleshoot my problem.
This isn't Cisco. And if you don't want help, I'll gladly not give it. You have precisely the kind of attitude found on a person most likely to overlook something because they think they know better, and that is why it's most important to start with the basics and work up.
NTP is UDP. UDP will follow the routing table. The interface binding controls what it binds to locally, but it still respects the routing table to find the interface it will exit from. If you bind to LAN, it will source the packets using the LAN IP address but the traffic still exits the firewall through whatever route gets it to the destination (e.g. the default route). Sourcing from the LAN and exiting WAN also means that it gets NAT applied.
On my test systems here, I can select LAN only and it still can synchronize time just fine, with otherwise stock NTP settings.
Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!
Need help fast? Netgate Global Support!
Do not Chat/PM for help!
-
@jimp said in Time is not syncing:
@brunovic said in Time is not syncing:
I feel like no one is talking to me like a network engineer. I never had this much difficulty trying to configure a Cisco router, firewall or switch. I may have screwed something up and I think the problem here is you guys are trying to troubleshoot my problem.
This isn't Cisco. And if you don't want help, I'll gladly not give it. You have precisely the kind of attitude found on a person most likely to overlook something because they think they know better, and that is why it's most important to start with the basics and work up.
NTP is UDP. UDP will follow the routing table. The interface binding controls what it binds to locally, but it still respects the routing table to find the interface it will exit from. If you bind to LAN, it will source the packets using the LAN IP address but the traffic still exits the firewall through whatever route gets it to the destination (e.g. the default route). Sourcing from the LAN and exiting WAN also means that it gets NAT applied.
On my test systems here, I can select LAN only and it still can synchronize time just fine, with otherwise stock NTP settings.
I understand this is not Cisco. What I am trying to do is to get you to understand that I understand the networking basics and from a network standpoint everything looks good. Now unless there is something that has been done without my knowledge THAT is what I need to know. But I would not set the internal interfaces to be the gateway because I know that will break network traffic. I've already confirmed this with you when I checked the LAN interface. Also IF this is a NAT issue the whole point of Network Address Translation is for internal class c addresses to source the WAN interface IP for external traffic. As I've demonstrated when sourcing the LAN interface IP I am able to ping the NTP server. If NAT was not working properly I should not be able to ping the NTP server from the LAN interface. So this leaves the question IF NAT is working properly and I am able to ping the NTP servers then WHY am I not able to sync with the NTP server when anything but the WAN interface is selected under the NTP Settings.
-
Boom THAT was why I had the manual NAT. Now my out-of-band management VLAN can get onto the internet and this violates DoD STIG requirements. THAT was why I was trying to keep the manual NAT. Again everything routes by default which creates THAT problem. I just need that network to be on its own separate from the rest of the networks. There are no rules on the ADMIN VLAN to allow anything so why am I able to route on the ADMIN VLAN. That was what I didn't want to do.
-
@brunovic said in Time is not syncing:
Boom THAT was why I had the manual NAT. Now my out-of-band management VLAN can get onto the internet and this violates DoD STIG requirements. THAT was why I was trying to keep the manual NAT. Again everything routes by default which creates THAT problem. I just need that network to be on its own separate from the rest of the networks. There are no rules on the ADMIN VLAN to allow anything so why am I able to route on the ADMIN VLAN. That was what I didn't want to do.
Because interface rules are checked in the inbound direction, not outbound. Through your lack of understanding of how pfSense works, you created the misconfiguration that allowed it to happen. You keep shooting your own feet and then wondering why it hurts.
You need to read through the docs more and understand how pfSense operates at a more fundamental level before ranting about how it doesn't work the way you expect. You're still applying Cisco concepts to pfSense when they do not apply at all.
-
WITH Auto NAT:
WITHOUT Auto NAT (Manual excluding the ADMIN network):
The second one is what I need to happen. There are no rules on the ADMIN VLAN however it is still able to route out.
-
YOU GOT TO BE KIDDING! The simple answer was to NOT select the ADMIN interface under NTP settings! I didn't even select it but when I remembered why I did manual NAT I had a hunch that that was the problem. BECAUSE traffic cannot route out the ADMIN interface NTP failed! That makes absolutely NO sense!
-
As you can see I've fixed it myself without your help. Instead of helping me you kept troubleshooting things that did not need troubleshooting. You kept arguing with me and would not listen to a word I said. I have said REPEATEDLY that NAT is not the problem because I was able to ping sourcing the LAN interface. You kept insisting it was the problem. I kept asking you HOW exactly the NTP client was reaching the NTP server. The best answer I got was that it was "listening" on those interfaces. That really does not help me out. If that is the case even IF the ADMIN interface which does not have a NAT rule was selected so was LAN and GUEST. So it should still have been able to reach the NTP server on those interfaces. I still do not understand WHY I need to remove the ADMIN interface in order for it to work and I doubt I will get a straight answer from you. But I needed to remove the ADMIN network from NAT because it was automatically routing traffic. This is why I brought up Cisco. NOT to show off but to give you a reference point of where I stand from a Network Engineer perspective. By default there are no routes when VTIs are created. That is what I was expecting from pfSense. Yes I know pfSense is NOT a Cisco device but I need THAT function to act like Cisco. Cisco has designed VLANs to be independent network FOR security reasons. To have automatic routing is a security vulnerability and I need for that to not happen. The ONLY work around I could find was to remove the NAT and make exclusion rule to segment off networks.
With ADMIN selected and Manual NAT:
Without ADMIN selected and Manual NAT:
-
Good for you ;)
I am glad it got sorted, for sure gives me more things to ask the next user on stuff they could of dicked up.
I agree with jimp here - you shot yourself in the foot.. You should of mentioned out of the gate that you were not using a default gateway and not using automatic nat, etc.
Unless the user mentions it, you have to assume pfsense is in a default configuration mode.. So normally these threads come down to pulling the info out of the user and trying to figure out what thing did they dick with or multiple things to break it..
-
This is BS: https://youtu.be/FlVjrB4SByQ?t=2m18s
You are saying there is an implicit deny in this video. That said if there are no rules then I should NOT be able to route between VLANs. Is that my "lack of understanding" you are referring to? If that is the case with no rules on the ADMIN interface I should not have been able to ping out on the WAN much less any other local network. Let me show you something. I will add the auto NAT rules back in and remove ALL rule on the ADMIN network and show you that I am still able to ping out and internally. IF there is an implicit deny statement then I should not be able to do this right? Then why am I able to do this? Please don't come at me with that "lack of understanding" crap. Your own documentation and video contradict the results. What I do understand is what is happening on my pfSense. If rules are supposed to allow traffic then why is it when I have no rules traffic is still allowed. THAT is why I had to manually configure my NAT!
-
As you can see I’ve fixed it myself without your help.
Good for you.
Instead of helping me you kept troubleshooting things that did not need troubleshooting. You kept arguing with me and would not listen to a word I said.
Except that I did, and you assumed you were right and I was wrong and missed the point completely.
I have said REPEATEDLY that NAT is not the problem because I was able to ping sourcing the LAN interface. You kept insisting it was the problem.
Except NAT was the problem. See below.
I kept asking you HOW exactly the NTP client was reaching the NTP server. The best answer I got was that it was “listening” on those interfaces. That really does not help me out.
Except that it was the most correct answer to what you asked with the information you provided. You did not show your NTP settings anywhere. You did not mention any "admin" interface being selected in NTP, only LAN.
If that is the case even IF the ADMIN interface which does not have a NAT rule was selected so was LAN and GUEST.
The lack of NAT for admin was the problem because it chose the Admin interface as the source. With multiple interfaces selected the OS picks whichever interface is "closest" to the targets, for whatever reason, Admin came up first in that decision making process.
So it should still have been able to reach the NTP server on those interfaces.
Except that it didn't, the NTP daemon picked the Admin interface for whatever reason, and NTP apparently doesn't try other addresses automatically.
I still do not understand WHY I need to remove the ADMIN interface in order for it to work and I doubt I will get a straight answer from you.
Because ADMIN has no outbound NAT, and NTP is trying to communicate with the outside world using the Admin interface IP address.
But I needed to remove the ADMIN network from NAT because it was automatically routing traffic.
Wrong. Taking it out of NAT does not prevent it from routing. The traffic still exits WAN, just without NAT. You need proper firewall rules.
This is why I brought up Cisco. NOT to show off but to give you a reference point of where I stand from a Network Engineer perspective.
But as you have shown, that experience means little to anything other than Cisco.
By default there are no routes when VTIs are created. That is what I was expecting from pfSense.
By default in pfSense there are no rules when interfaces are created.
Yes I know pfSense is NOT a Cisco device but I need THAT function to act like Cisco. Cisco has designed VLANs to be independent network FOR security reasons. To have automatic routing is a security vulnerability and I need for that to not happen. The ONLY work around I could find was to remove the NAT and make exclusion rule to segment off networks.
Again, it works this way by default if you create a proper set of firewall rules. It isn't a security vulnerability, it's mismanagement by the admin.
-
@brunovic said in Time is not syncing:
This is BS: https://youtu.be/FlVjrB4SByQ?t=2m18s
You are saying there is an implicit deny in this video. That said if there are no rules then I should NOT be able to route between VLANs. Is that my "lack of understanding" you are referring to? If that is the case with no rules on the ADMIN interface I should not have been able to ping out on the WAN much less any other local network. Let me show you something. I will add the auto NAT rules back in and remove ALL rule on the ADMIN network and show you that I am still able to ping out and internally. IF there is an implicit deny statement then I should not be able to do this right? Then why am I able to do this? Please don't come at me with that "lack of understanding" crap. Your own documentation and video contradict the results. What I do understand is what is happening on my pfSense. If rules are supposed to allow traffic then why is it when I have no rules traffic is still allowed. THAT is why I had to manually configure my NAT!
Pinging from the firewall itself that traffic does not enter the interface and thus is not subjected to the rules on interface tabs.
Your testing is flawed, as is your understanding.
-
Locking this as it's gone completely off topic.
