NTP, SSO and multiple firewalls

[ozbob]

Hi,
I have been messing around for a while with one virtual pfsense box and one physical. The virtual one protects the internal LAN and is more restricted. It is using proxy and pfblockerng. So INT_LAN -> pfsense1 -> DMZ -> -pfsense2 -> Internet.  The first pfsens1 not using NAT.
I got most things working having pfsense1 in production use and two still under test.  Issues that still exist on pfsense1 are; proxy authentication back to transparant as login kept creating issues with popping up logon boxes on some machines. Using ldap authentication was working however not automatic (is there any way to do so? SSO?)

Another issue I am having is NTP timesync, when I turn off vm timesync is get 2 hrs of while timezone settings are correct. When I fill out NTP sources thay always stay unreachable even  when coming from the local lan. The NTP server does not communicate with it pears for unknown reasons. Firewall rules are in place and I do have it working for pfsense2 that box syncs fine. Can it be that the vm is an issue? its two hours off when not syncing hw clock but when I sync it works against syncing with ext. ntp.
So I tried using an ntp client on a workstation to confirm ntp is not blocked and the tool tells me is can sync over ntp. Looking at the box again using pftop I see port 123 linked to the virtual adapter that pfblockerng is using, don't see this on the pfsense2. Tried NAt tried setting specific gw for port 123 nothing seems to work.
When looking at the fw logs of pfsense01 I don't get any hits filtering on port 123, when I do on pfsense2 I see various most on the loopback interface.
Especially the fw log I don't understand at all, ther rules are in place I see there are hits on the rules, ntp traffic seems to pass through otherwise the windows tool with not respond NTP requests.
Am I overlooking something here? NAT should be turned off on the first pfsense instance I would say, I have port 123 open same as on pfsense2 so it should work. Any suggestions where to takes this from here?