Is it possible to serve time for Windows?

dimskraft

I can set time.windows.com and have Windows automatically synchronize time with Internet. But if I set IP address of pfSense box, Windows is unable to sync.

Is it possible to set up on server side?

viragomann

Is the NTP service configured on pfSense (Services > NTP)?

Why do you think, Windows doesn't sync?
Try

w32tm /stripchart /computer:<pfSense IP>

Also ensure that access to pfSense UDP/123 is permitted.

JeGr

Also check for some AD dark magic that sets Windows to a setting that won't work with standard-NTP servers. There was something about SNTP servers I remember vaguely that made it incompatible with normal running default NTP. Resetting that via an AD directive to "normal" NTP fixed it. Normally SNTP and NTP aren't incompatible but somehow our Windows DC didn't "understand" that ;)

provels

I tried it for a while, but it seemed to fail more than it succeeded (workgroup only). Even NTP for the FW itself would fail at times. Nothing wrong with time.windows,com. Always works.

johnpoz

@provels said in Is it possible to serve time for Windows?:

Nothing wrong with time.windows,com. Always works.

Not true at all... Back in 2017 there was a massive issue where it was sending out the wrong time ;)

Even NTP for the FW itself would fail at times

Well where were you pointing it - pool? Or time.windows.com???

NTP is rock solid protocol.. And just works - unless you have something blocking it or some serious network issues. I always just replace the built in windows time stuff with the official ntp client..

Out of the box pretty sure windows before 10 just used sntp, and you need to make some reg changes if you want it to actually use nt with the built in stuff. But a sntp client can get time from any ntp server - its just how it works that is different.

What flavor of windows are you running? But yeah if you want to use pfsense - you need to validate its ntp is actually running and working, and you have firewall rules to allow access to it.

If you want to use the actual ntp client for windows you can grab copy here
https://www.meinbergglobal.com/english/sw/ntp.htm#ntp_stable

q54e3w

Heres how I configure my Server 2016/2019 boxes with pfSense NTP server.

On fresh boot syncs with time.microsoft.com

w32tm /query /status

Leap Indicator: 0(no warning)
Stratum: 3 (secondary reference - syncd by (S)NTP)
Precision: -23 (119.209ns per tick)
Root Delay: 0.0843484s
Root Dispersion: 0.0506468s
ReferenceId: 0x34ADC1A6 (source IP:  __52.173.193.166__)
Last Successful Sync Time: 6/23/2019 7:15:05 PM
Source: time.windows.com,0x8
Poll Interval: 10 (1024s)

set IP address to pfSense NTP server

w32tm /config /manualpeerlist:192.168.10.1 /syncfromflags:MANUAL

stop and start the time service

stop-service w32time
start-service w32time

give it s few moments and verify its syncing correctly.

w32tm /query /status

Leap Indicator: 0(no warning)
Stratum: 3 (secondary reference - syncd by (S)NTP)
Precision: -23 (119.209ns per tick)
Root Delay: 0.0006681s
Root Dispersion: 7.7694645s
ReferenceId: 0xC0A80A01 (source IP:  192.168.10.1)
Last Successful Sync Time: 6/23/2019 7:17:54 PM
Source: 192.168.10.1
Poll Interval: 6 (64s)

and after some time it will be more accurate

w32tm /query /status
Leap Indicator: 0(no warning)
Stratum: 3 (secondary reference - syncd by (S)NTP)
Precision: -23 (119.209ns per tick)
Root Delay: 0.0004008s
Root Dispersion: 0.0414628s
ReferenceId: 0xC0A80A01 (source IP:  192.168.10.1)
Last Successful Sync Time: 6/29/2019 12:18:32 AM
Source: 192.168.10.1
Poll Interval: 9 (512s)

JeGr

No problems here either after reconfiguring AD with changes to (S)NTP it was working rock solid as always.

Margod

I'd recommend check if your pfSense is set to provide NTP services. Head over to the "Services" menu, then hit "NTP." Make sure it's enabled, and you're good to go.

Stevenadry

To get your Windows syncing with a pfSense box, there might be a couple of things you need to check. First, make sure the NTP server is properly configured on your pfSense box. Then, check your firewall rules to ensure that the NTP traffic isn't being blocked.

JonathanLee

Yes I do. I do it by way of NAT port forwarding so it redirects to the firewall.

(NAT RULE)

(NAT port forwarding)

My system serves time via encrypted connection to NIST.

Now anything on the network goes to the firewall for time.

JonathanLee

This way it does not matter what requests it sends out the firewall responds

Devices get requests sent to the firewall transparently, no more 1980s NTP protocol issues this way.