• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

NTP server issues

General pfSense Questions
5
45
6.0k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • S
    stephenw10 Netgate Administrator
    last edited by Apr 12, 2020, 11:57 AM

    There is a difference between having a host resolve as a local IP and redirecting to the same local IP though.

    Perhaps the switches are using some ntp authentication and will only sync to Netgear's pool? It would be the first time I've seen that though.

    Run a packet capture and find out. Whatever they are using it's clearly on port 123 since redirecting that breaks it. Should be easy enough to capture.

    Steve

    1 Reply Last reply Reply Quote 0
    • J
      johnpoz LAYER 8 Global Moderator
      last edited by johnpoz Apr 12, 2020, 12:33 PM Apr 12, 2020, 12:09 PM

      pfsense is a standard ntp service - running the latest version 4.2.8p14.. Anything designed to use ntp would work...

      There is nothing fancy about gs108v3 - pretty sure I have one of those on the shelf even..

      Yup, sure do... Give me a sec to plug it in and sent its ntp up...

      Ok - the GS108Ev3 doesn't even have time settings..

      login-to-view

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

      4 1 Reply Last reply Apr 12, 2020, 1:32 PM Reply Quote 0
      • J
        JKnott @johnpoz
        last edited by JKnott Apr 12, 2020, 12:40 PM Apr 12, 2020, 12:39 PM

        @johnpoz said in NTP server issues:

        I have never seen a device hard code an IP for ntp... They always use either a vendor fqdn, pool, or other tqdn.

        My tablet does that. I have an Asus Zenpad 10 which uses 5.144.132.2.123 for ntp. The host command does not return a host name.

        host 5.144.132.2.123
        Host 5.144.132.2.123 not found: 3(NXDOMAIN)

        There is no ntp setting on this tablet that I can find.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        4 1 Reply Last reply Apr 12, 2020, 1:45 PM Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz Apr 12, 2020, 12:53 PM Apr 12, 2020, 12:45 PM

          5-144-132-2.static.hostiran.name

          That is IP in Iran...

          Why would they hard code an IP in iran? That makes ZERO sense!!

          its part of the pool for global, asia and iran..
          https://www.ntppool.org/scores/5.144.132.2

          So what is likely is you missed the query where it found that IP via dns via a query to ntp pool..

          You would have to be a complete an utter moron to hard code an IP for some mass produced device to use.. When if that IP goes away, what if can not run ntp on it. What if you sell 10 million devices that all now point to a single IP, etc. etc..

          They query a pool fqdn, and pick and IP.. or multiples from this pool..

          But its clear why his switch gs108Ev3 can not sync time - is because it has no settings for that at all.. It has no log that I can see.. so what point of time would it have?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          J 1 Reply Last reply Apr 12, 2020, 1:31 PM Reply Quote 0
          • J
            JKnott @johnpoz
            last edited by Apr 12, 2020, 1:31 PM

            @johnpoz said in NTP server issues:

            So what is likely is you missed the query where it found that IP via dns via a query to ntp pool..

            Actually, I did watch for DNS when I first noticed that and didn't see any. Also, if it queried pool.ntp.org, it should have got an address on my LAN, as I have a host override to point to my pfSense firewall.

            It's not the first time I've seen a manufacturer do something stupid. Seems to me there's a switch & AP manufacturer that couldn't do VLANs right. 😉

            PfSense running on Qotom mini PC
            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
            UniFi AC-Lite access point

            I haven't lost my mind. It's around here...somewhere...

            1 Reply Last reply Reply Quote 0
            • 4
              4o4rh @johnpoz
              last edited by Apr 12, 2020, 1:32 PM

              @johnpoz I have the pro version, you have the plus. You don't seem to have many of the features that i have.
              Time is under System, Management, Time. But like i say, you are missing a whole bunch of stuff like switching, routing, qos, etc

              1 Reply Last reply Reply Quote 0
              • J
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz Apr 12, 2020, 1:42 PM Apr 12, 2020, 1:36 PM

                @JKnott said in NTP server issues:

                it should have got an address on my LAN

                How do you know it didn't query asia.pool.ntp.org or 0.pool.ntp.org, 1.pool.ntp.org, do you have a wildcard setup?

                Again any sntp client could query the ntp service that pfsense is running... It is the the ntp server that owns the internet to be honest.. Sniff the traffic.. What do you see.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                J 1 Reply Last reply Apr 12, 2020, 1:46 PM Reply Quote 0
                • 4
                  4o4rh @JKnott
                  last edited by Apr 12, 2020, 1:45 PM

                  @JKnott i removed all timeservers except for the pfsense box and i am getting TCP 66 to 52.211.208.165

                  1 Reply Last reply Reply Quote 0
                  • J
                    JKnott @johnpoz
                    last edited by Apr 12, 2020, 1:46 PM

                    @johnpoz

                    While you were posting that, I checked again and it is indeed querying asia.pool.ntp.org. I don't know how I missed that before.

                    This is one example of where using Wireshark is better than Packet Capture. With Wireshark I can filter on both DNS and NTP at the same time, along with the MAC address, whereas Packet Capture can only filter on 1 protocol at a time, along with MAC or IP address.

                    Still, given that the tablets are used around the world, it would be better if they just used pool.ntp.org, instead of asia.pool.ntp.org. Using pool.ntp.org will provide a regional address.

                    Guess it's time for another host override.

                    PfSense running on Qotom mini PC
                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                    UniFi AC-Lite access point

                    I haven't lost my mind. It's around here...somewhere...

                    1 Reply Last reply Reply Quote 0
                    • J
                      johnpoz LAYER 8 Global Moderator
                      last edited by johnpoz Apr 12, 2020, 1:52 PM Apr 12, 2020, 1:48 PM

                      yup same sort of nonsense with my smart plugs using uk.pool ;) hehehe

                      you can download the pcap.. Your pfsense box sure and the F is not 52.211.x.x is it??

                      That is a aws IP, and is not in the pool.

                      And I don't show it answering ntp.. And TCP is not what sntp or ntp uses.. anyway. Are you trying to say port tcp 66 to that IP? That sure and the hell has nothing to do with time. Or is the packet size... sniff on port 123 UDP.. And then open it in wireshark - attach a copy..

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      4 1 Reply Last reply Apr 12, 2020, 1:54 PM Reply Quote 0
                      • 4
                        4o4rh @johnpoz
                        last edited by Apr 12, 2020, 1:54 PM

                        @johnpoz how can i export just the 4 ntp lines from wireshark
                        ntp client
                        ntp server
                        ntp client
                        ntp server

                        1 Reply Last reply Reply Quote 0
                        • J
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz Apr 12, 2020, 1:55 PM Apr 12, 2020, 1:55 PM

                          Attache the pcap.. If you sniffed on 123 and the IP of your switch all that would be in there is its query for ntp and answers.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          J 4 2 Replies Last reply Apr 12, 2020, 1:58 PM Reply Quote 0
                          • J
                            JKnott @johnpoz
                            last edited by Apr 12, 2020, 1:58 PM

                            @johnpoz

                            I often filter on the MAC, to capture both IPv4 and IPv6.

                            PfSense running on Qotom mini PC
                            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                            UniFi AC-Lite access point

                            I haven't lost my mind. It's around here...somewhere...

                            1 Reply Last reply Reply Quote 0
                            • J
                              johnpoz LAYER 8 Global Moderator
                              last edited by johnpoz Apr 12, 2020, 2:01 PM Apr 12, 2020, 2:00 PM

                              Thats fine - is is switch running IPv6.. He made no mention of that.. Here is query from my pc to my ntp server.. That captured with pfsense

                              Since its routed from my lan to my segment my pi ntp server sites in.

                              ntp.pcap

                              You can download that and open in wireshark as example of ntp query and answer.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                              1 Reply Last reply Reply Quote 0
                              • 4
                                4o4rh @johnpoz
                                last edited by Apr 12, 2020, 2:02 PM

                                @johnpoz ntp_dump.pcap i notice in the two server entries, the first one is giving the address 127.0.0.1 and the second says unidentified reference source 'rate'

                                1 Reply Last reply Reply Quote 0
                                • J
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by johnpoz Apr 12, 2020, 2:06 PM Apr 12, 2020, 2:04 PM

                                  That shows that your ntp on pfsense is not in sync... Show us the status of ntp on pfsense.

                                  login-to-view

                                  Here is what typical should look like

                                  login-to-view

                                  Says right there that your clock is unsynced

                                  login-to-view

                                  So no - no clients at all should sync with that..

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                  4 1 Reply Last reply Apr 12, 2020, 2:08 PM Reply Quote 0
                                  • 4
                                    4o4rh @johnpoz
                                    last edited by Apr 12, 2020, 2:08 PM

                                    @johnpoz login-to-view

                                    1 Reply Last reply Reply Quote 0
                                    • J
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by johnpoz Apr 12, 2020, 2:12 PM Apr 12, 2020, 2:09 PM

                                      So pfsense can not talk to any ntp servers, so no shit nobody is going to be able to sync time with it.

                                      your reach needs to be 377... And looks like you hae those set as pool placeholders... But they prob never resolved.

                                      example
                                      login-to-view

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                      4 1 Reply Last reply Apr 12, 2020, 2:18 PM Reply Quote 0
                                      • 4
                                        4o4rh @johnpoz
                                        last edited by Apr 12, 2020, 2:18 PM

                                        @johnpoz i had the interface set to all the LAN/VLAN addresses. Now i changed it to the WAN/VPN and chugging.

                                        1 Reply Last reply Reply Quote 0
                                        • J
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by johnpoz Apr 12, 2020, 2:22 PM Apr 12, 2020, 2:20 PM

                                          Ok once you see it in sync.. Then your switch should sync with it... But when it is unsync like that, no ntp client would sync.

                                          You changed it to what? Your ntp services doesn't need to listen on your wan/vpn... You mean your dns was not using your wan/vpn to resolve with?

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                          4 1 Reply Last reply Apr 12, 2020, 3:00 PM Reply Quote 0
                                          19 out of 45
                                          • First post
                                            19/45
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.