Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NTP server issues

    Scheduled Pinned Locked Moved General pfSense Questions
    45 Posts 5 Posters 7.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by johnpoz

      yup same sort of nonsense with my smart plugs using uk.pool ;) hehehe

      you can download the pcap.. Your pfsense box sure and the F is not 52.211.x.x is it??

      That is a aws IP, and is not in the pool.

      And I don't show it answering ntp.. And TCP is not what sntp or ntp uses.. anyway. Are you trying to say port tcp 66 to that IP? That sure and the hell has nothing to do with time. Or is the packet size... sniff on port 123 UDP.. And then open it in wireshark - attach a copy..

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      4 1 Reply Last reply Reply Quote 0
      • 4
        4o4rh @johnpoz
        last edited by

        @johnpoz how can i export just the 4 ntp lines from wireshark
        ntp client
        ntp server
        ntp client
        ntp server

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz

          Attache the pcap.. If you sniffed on 123 and the IP of your switch all that would be in there is its query for ntp and answers.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          JKnottJ 4 2 Replies Last reply Reply Quote 0
          • JKnottJ
            JKnott @johnpoz
            last edited by

            @johnpoz

            I often filter on the MAC, to capture both IPv4 and IPv6.

            PfSense running on Qotom mini PC
            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
            UniFi AC-Lite access point

            I haven't lost my mind. It's around here...somewhere...

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by johnpoz

              Thats fine - is is switch running IPv6.. He made no mention of that.. Here is query from my pc to my ntp server.. That captured with pfsense

              Since its routed from my lan to my segment my pi ntp server sites in.

              ntp.pcap

              You can download that and open in wireshark as example of ntp query and answer.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • 4
                4o4rh @johnpoz
                last edited by

                @johnpoz ntp_dump.pcap i notice in the two server entries, the first one is giving the address 127.0.0.1 and the second says unidentified reference source 'rate'

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by johnpoz

                  That shows that your ntp on pfsense is not in sync... Show us the status of ntp on pfsense.

                  ntp.jpg

                  Here is what typical should look like

                  buthere.jpg

                  Says right there that your clock is unsynced

                  notsync.jpg

                  So no - no clients at all should sync with that..

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  4 1 Reply Last reply Reply Quote 0
                  • 4
                    4o4rh @johnpoz
                    last edited by

                    @johnpoz Selection_011.png

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by johnpoz

                      So pfsense can not talk to any ntp servers, so no shit nobody is going to be able to sync time with it.

                      your reach needs to be 377... And looks like you hae those set as pool placeholders... But they prob never resolved.

                      example
                      lookup.jpg

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      4 1 Reply Last reply Reply Quote 0
                      • 4
                        4o4rh @johnpoz
                        last edited by

                        @johnpoz i had the interface set to all the LAN/VLAN addresses. Now i changed it to the WAN/VPN and chugging.

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz

                          Ok once you see it in sync.. Then your switch should sync with it... But when it is unsync like that, no ntp client would sync.

                          You changed it to what? Your ntp services doesn't need to listen on your wan/vpn... You mean your dns was not using your wan/vpn to resolve with?

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          4 1 Reply Last reply Reply Quote 0
                          • 4
                            4o4rh
                            last edited by 4o4rh

                            @johnpoz I originally had the Listen Interface selecting only the LAN/VLANS, but not the WAN/VPNs, now i reversed it.

                            should i listen on both wan and vpn, or just wan?
                            is europe pool ntp org enough, or should i add individual country pools?
                            How do i know when it is in sync

                            Selection_012.png

                            4 1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Wait until you have entries showing reach 377 and an active peer. Check the logs.
                              But that looks good now.

                              4 1 Reply Last reply Reply Quote 0
                              • 4
                                4o4rh @4o4rh
                                last edited by 4o4rh

                                @gwaitsi hmm... interesting.

                                1. if i select no interface items, it works.
                                2. if i select all the vlan/lan interfaces only, it does not work
                                3. if i select the wan/vpn interfaces only , it works
                                4. if i select the vlan interfaces only, works
                                5. if i select the lan interfaces (3) only, it does not work
                                6. if i select any one of the lan interfaces, it does not work.

                                So the issue seems to be with having ntp listen on a lan interface
                                *** So i confirmed it, if i enter the pfsense vlan address as the time server, netgear successfully updates ***

                                so, what can be breaking the NTP if i select the lan interfaces to listen on

                                1 Reply Last reply Reply Quote 0
                                • 4
                                  4o4rh @johnpoz
                                  last edited by 4o4rh

                                  @johnpoz @stephenw10 You can see what happens igb1.50 (vlan) is working.
                                  Then i add a LAN interface to listen on and you see it falls over. why is the lan interface adding 0.0.0.0 instead of the lan address? this is a bug right?

                                  Selection_014.png

                                  1 Reply Last reply Reply Quote 0
                                  • 4
                                    4o4rh @stephenw10
                                    last edited by

                                    @stephenw10 where can i find the ntp configuration files to see what is being written

                                    1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by johnpoz

                                      You only need to listen on your interfaces you want to serve time on... My guess since you mention vpn, is you went to manual and now your not natting loopback, so when an application tries to use that as source to talk pfsense doesn't nat it and you can not talk..

                                      So the only why ntp would be able to talk to ntp servers is if bound to interface, the 0.0.0.0 is bind to all... Post up your outbound nats, Bet you a beer you don't have loopback natting..

                                      outboundnat.jpg

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        /var/etc/ntpd.conf

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          See I am only listening on a few interfaces...

                                          [2.4.5-RELEASE][admin@sg4860.local.lan]/root: cat /var/etc/ntpd.conf 
                                          # 
                                          # pfSense ntp configuration file 
                                          # 
                                          
                                          tinker panic 0 
                                          # Orphan mode stratum
                                          tos orphan 12
                                          
                                          
                                          # Upstream Servers
                                          server 192.168.3.32 iburst maxpoll 9 prefer
                                          pool us.pool.ntp.org iburst maxpoll 9
                                          
                                          
                                          enable stats
                                          statistics clockstats loopstats peerstats
                                          statsdir /var/log/ntp
                                          logconfig =syncall +clockall +peerall +sysall
                                          driftfile /var/db/ntpd.drift
                                          restrict default kod limited nomodify nopeer notrap
                                          restrict -6 default kod limited nomodify nopeer notrap
                                          restrict source kod limited nomodify notrap
                                          interface ignore all
                                          interface ignore wildcard
                                          interface listen igb3
                                          interface listen igb0
                                          interface listen igb2
                                          interface listen igb2.4
                                          interface listen igb5
                                          [2.4.5-RELEASE][admin@sg4860.local.lan]/root: 
                                          

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          4 2 Replies Last reply Reply Quote 0
                                          • 4
                                            4o4rh @johnpoz
                                            last edited by

                                            @johnpoz I want to listen on the lan interfaces for switches/access point devices and vlans for end user equip.

                                            I have the same config for each of the VPNs and they work

                                            Selection_015.png
                                            Selection_016.png

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.