Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NTP server issues

    Scheduled Pinned Locked Moved General pfSense Questions
    45 Posts 5 Posters 7.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by johnpoz

      Attache the pcap.. If you sniffed on 123 and the IP of your switch all that would be in there is its query for ntp and answers.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      JKnottJ 4 2 Replies Last reply Reply Quote 0
      • JKnottJ
        JKnott @johnpoz
        last edited by

        @johnpoz

        I often filter on the MAC, to capture both IPv4 and IPv6.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz

          Thats fine - is is switch running IPv6.. He made no mention of that.. Here is query from my pc to my ntp server.. That captured with pfsense

          Since its routed from my lan to my segment my pi ntp server sites in.

          ntp.pcap

          You can download that and open in wireshark as example of ntp query and answer.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • 4
            4o4rh @johnpoz
            last edited by

            @johnpoz ntp_dump.pcap i notice in the two server entries, the first one is giving the address 127.0.0.1 and the second says unidentified reference source 'rate'

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by johnpoz

              That shows that your ntp on pfsense is not in sync... Show us the status of ntp on pfsense.

              ntp.jpg

              Here is what typical should look like

              buthere.jpg

              Says right there that your clock is unsynced

              notsync.jpg

              So no - no clients at all should sync with that..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              4 1 Reply Last reply Reply Quote 0
              • 4
                4o4rh @johnpoz
                last edited by

                @johnpoz Selection_011.png

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by johnpoz

                  So pfsense can not talk to any ntp servers, so no shit nobody is going to be able to sync time with it.

                  your reach needs to be 377... And looks like you hae those set as pool placeholders... But they prob never resolved.

                  example
                  lookup.jpg

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  4 1 Reply Last reply Reply Quote 0
                  • 4
                    4o4rh @johnpoz
                    last edited by

                    @johnpoz i had the interface set to all the LAN/VLAN addresses. Now i changed it to the WAN/VPN and chugging.

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by johnpoz

                      Ok once you see it in sync.. Then your switch should sync with it... But when it is unsync like that, no ntp client would sync.

                      You changed it to what? Your ntp services doesn't need to listen on your wan/vpn... You mean your dns was not using your wan/vpn to resolve with?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      4 1 Reply Last reply Reply Quote 0
                      • 4
                        4o4rh
                        last edited by 4o4rh

                        @johnpoz I originally had the Listen Interface selecting only the LAN/VLANS, but not the WAN/VPNs, now i reversed it.

                        should i listen on both wan and vpn, or just wan?
                        is europe pool ntp org enough, or should i add individual country pools?
                        How do i know when it is in sync

                        Selection_012.png

                        4 1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          Wait until you have entries showing reach 377 and an active peer. Check the logs.
                          But that looks good now.

                          4 1 Reply Last reply Reply Quote 0
                          • 4
                            4o4rh @4o4rh
                            last edited by 4o4rh

                            @gwaitsi hmm... interesting.

                            1. if i select no interface items, it works.
                            2. if i select all the vlan/lan interfaces only, it does not work
                            3. if i select the wan/vpn interfaces only , it works
                            4. if i select the vlan interfaces only, works
                            5. if i select the lan interfaces (3) only, it does not work
                            6. if i select any one of the lan interfaces, it does not work.

                            So the issue seems to be with having ntp listen on a lan interface
                            *** So i confirmed it, if i enter the pfsense vlan address as the time server, netgear successfully updates ***

                            so, what can be breaking the NTP if i select the lan interfaces to listen on

                            1 Reply Last reply Reply Quote 0
                            • 4
                              4o4rh @johnpoz
                              last edited by 4o4rh

                              @johnpoz @stephenw10 You can see what happens igb1.50 (vlan) is working.
                              Then i add a LAN interface to listen on and you see it falls over. why is the lan interface adding 0.0.0.0 instead of the lan address? this is a bug right?

                              Selection_014.png

                              1 Reply Last reply Reply Quote 0
                              • 4
                                4o4rh @stephenw10
                                last edited by

                                @stephenw10 where can i find the ntp configuration files to see what is being written

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by johnpoz

                                  You only need to listen on your interfaces you want to serve time on... My guess since you mention vpn, is you went to manual and now your not natting loopback, so when an application tries to use that as source to talk pfsense doesn't nat it and you can not talk..

                                  So the only why ntp would be able to talk to ntp servers is if bound to interface, the 0.0.0.0 is bind to all... Post up your outbound nats, Bet you a beer you don't have loopback natting..

                                  outboundnat.jpg

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    /var/etc/ntpd.conf

                                    1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by

                                      See I am only listening on a few interfaces...

                                      [2.4.5-RELEASE][admin@sg4860.local.lan]/root: cat /var/etc/ntpd.conf 
                                      # 
                                      # pfSense ntp configuration file 
                                      # 
                                      
                                      tinker panic 0 
                                      # Orphan mode stratum
                                      tos orphan 12
                                      
                                      
                                      # Upstream Servers
                                      server 192.168.3.32 iburst maxpoll 9 prefer
                                      pool us.pool.ntp.org iburst maxpoll 9
                                      
                                      
                                      enable stats
                                      statistics clockstats loopstats peerstats
                                      statsdir /var/log/ntp
                                      logconfig =syncall +clockall +peerall +sysall
                                      driftfile /var/db/ntpd.drift
                                      restrict default kod limited nomodify nopeer notrap
                                      restrict -6 default kod limited nomodify nopeer notrap
                                      restrict source kod limited nomodify notrap
                                      interface ignore all
                                      interface ignore wildcard
                                      interface listen igb3
                                      interface listen igb0
                                      interface listen igb2
                                      interface listen igb2.4
                                      interface listen igb5
                                      [2.4.5-RELEASE][admin@sg4860.local.lan]/root: 
                                      

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      4 2 Replies Last reply Reply Quote 0
                                      • 4
                                        4o4rh @johnpoz
                                        last edited by

                                        @johnpoz I want to listen on the lan interfaces for switches/access point devices and vlans for end user equip.

                                        I have the same config for each of the VPNs and they work

                                        Selection_015.png
                                        Selection_016.png

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by johnpoz

                                          Exactly I only listen on a few of my local lan side interfaces... I don't see ::1/128 listed there.. maybe its trying to do ipv6?

                                          I really don't see the point of doing manual outbound nat.. Why would you not just use automatic, and set hybrid for the stuff you want to policy route out your vpn..

                                          Do you not have ntp listening on an interface that you nat?

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • 4
                                            4o4rh @johnpoz
                                            last edited by

                                            @johnpoz If i use a single LAN interface, it looks like this

                                            # 
                                            # pfSense ntp configuration file 
                                            # 
                                            
                                            tinker panic 0 
                                            # Orphan mode stratum
                                            tos orphan 12
                                            
                                            
                                            # Upstream Servers
                                            pool nl.pool.ntp.org iburst maxpoll 9
                                            pool de.pool.ntp.org iburst maxpoll 9
                                            
                                            
                                            enable stats
                                            statistics clockstats loopstats peerstats
                                            statsdir /var/log/ntp
                                            logconfig =syncall +clockall +peerall +sysall
                                            driftfile /var/db/ntpd.drift
                                            restrict default kod limited nomodify nopeer notrap
                                            restrict -6 default kod limited nomodify nopeer notrap
                                            restrict source kod limited nomodify notrap
                                            interface ignore all
                                            interface ignore wildcard
                                            interface listen igb1
                                            

                                            Selection_017.png

                                            Selection_018.png

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.