NTP server issues

JKnott

I often filter on the MAC, to capture both IPv4 and IPv6.

johnpoz

Thats fine - is is switch running IPv6.. He made no mention of that.. Here is query from my pc to my ntp server.. That captured with pfsense

Since its routed from my lan to my segment my pi ntp server sites in.

ntp.pcap

You can download that and open in wireshark as example of ntp query and answer.

4o4rh

@johnpoz ntp_dump.pcap i notice in the two server entries, the first one is giving the address 127.0.0.1 and the second says unidentified reference source 'rate'

johnpoz

That shows that your ntp on pfsense is not in sync... Show us the status of ntp on pfsense.

Here is what typical should look like

Says right there that your clock is unsynced

So no - no clients at all should sync with that..

4o4rh

@johnpoz

johnpoz

So pfsense can not talk to any ntp servers, so no shit nobody is going to be able to sync time with it.

your reach needs to be 377... And looks like you hae those set as pool placeholders... But they prob never resolved.

example

4o4rh

@johnpoz i had the interface set to all the LAN/VLAN addresses. Now i changed it to the WAN/VPN and chugging.

johnpoz

Ok once you see it in sync.. Then your switch should sync with it... But when it is unsync like that, no ntp client would sync.

You changed it to what? Your ntp services doesn't need to listen on your wan/vpn... You mean your dns was not using your wan/vpn to resolve with?

4o4rh

@johnpoz I originally had the Listen Interface selecting only the LAN/VLANS, but not the WAN/VPNs, now i reversed it.

should i listen on both wan and vpn, or just wan?
is europe pool ntp org enough, or should i add individual country pools?
How do i know when it is in sync

stephenw10

Wait until you have entries showing reach 377 and an active peer. Check the logs.
But that looks good now.

4o4rh

@gwaitsi hmm... interesting.

if i select no interface items, it works.
if i select all the vlan/lan interfaces only, it does not work
if i select the wan/vpn interfaces only , it works
if i select the vlan interfaces only, works
if i select the lan interfaces (3) only, it does not work
if i select any one of the lan interfaces, it does not work.

So the issue seems to be with having ntp listen on a lan interface
*** So i confirmed it, if i enter the pfsense vlan address as the time server, netgear successfully updates ***

so, what can be breaking the NTP if i select the lan interfaces to listen on

4o4rh

@johnpoz @stephenw10 You can see what happens igb1.50 (vlan) is working.
Then i add a LAN interface to listen on and you see it falls over. why is the lan interface adding 0.0.0.0 instead of the lan address? this is a bug right?

4o4rh

@stephenw10 where can i find the ntp configuration files to see what is being written

johnpoz

You only need to listen on your interfaces you want to serve time on... My guess since you mention vpn, is you went to manual and now your not natting loopback, so when an application tries to use that as source to talk pfsense doesn't nat it and you can not talk..

So the only why ntp would be able to talk to ntp servers is if bound to interface, the 0.0.0.0 is bind to all... Post up your outbound nats, Bet you a beer you don't have loopback natting..

stephenw10

/var/etc/ntpd.conf

johnpoz

See I am only listening on a few interfaces...

[2.4.5-RELEASE][admin@sg4860.local.lan]/root: cat /var/etc/ntpd.conf 
# 
# pfSense ntp configuration file 
# 

tinker panic 0 
# Orphan mode stratum
tos orphan 12


# Upstream Servers
server 192.168.3.32 iburst maxpoll 9 prefer
pool us.pool.ntp.org iburst maxpoll 9


enable stats
statistics clockstats loopstats peerstats
statsdir /var/log/ntp
logconfig =syncall +clockall +peerall +sysall
driftfile /var/db/ntpd.drift
restrict default kod limited nomodify nopeer notrap
restrict -6 default kod limited nomodify nopeer notrap
restrict source kod limited nomodify notrap
interface ignore all
interface ignore wildcard
interface listen igb3
interface listen igb0
interface listen igb2
interface listen igb2.4
interface listen igb5
[2.4.5-RELEASE][admin@sg4860.local.lan]/root:

4o4rh

@johnpoz I want to listen on the lan interfaces for switches/access point devices and vlans for end user equip.

I have the same config for each of the VPNs and they work

johnpoz

Exactly I only listen on a few of my local lan side interfaces... I don't see ::1/128 listed there.. maybe its trying to do ipv6?

I really don't see the point of doing manual outbound nat.. Why would you not just use automatic, and set hybrid for the stuff you want to policy route out your vpn..

Do you not have ntp listening on an interface that you nat?

4o4rh

@johnpoz If i use a single LAN interface, it looks like this

# 
# pfSense ntp configuration file 
# 

tinker panic 0 
# Orphan mode stratum
tos orphan 12


# Upstream Servers
pool nl.pool.ntp.org iburst maxpoll 9
pool de.pool.ntp.org iburst maxpoll 9


enable stats
statistics clockstats loopstats peerstats
statsdir /var/log/ntp
logconfig =syncall +clockall +peerall +sysall
driftfile /var/db/ntpd.drift
restrict default kod limited nomodify nopeer notrap
restrict -6 default kod limited nomodify nopeer notrap
restrict source kod limited nomodify notrap
interface ignore all
interface ignore wildcard
interface listen igb1

johnpoz

So you have a vip on igb1?

I would sniff on your wan - do you see traffic going out to those servers? With source IP natted to your wan IP?

Is your default route out your wan, or via vpn.. IE you pulled routes?