Time is not syncing


  • Banned

    I am having issues with my TOTP and I am noticing that the time of my pfsense is off by two minutes from the time of my client. I've configured both the pfsense and my client with the same ntp server: 0.north-america.pool.ntp.org but the pfsense is still off by two minutes.


  • Rebel Alliance

    Is the pfsense actually syncing to ntp? What does the status of your ntp service show in pfsense?

    0_1528987692807_ntpstatus.png


  • Banned

    0_1528989464266_Capture03.JPG


  • Galactic Empire

    @brunovic said in Time is not syncing:

    0_1528989464266_Capture03.JPG

    Try using:-

    0.pool.ntp.org to 3.pool.ntp.org

    Does it then sync ?

    "NTP will only sync if a majority of the servers agree on the time. For best results you should configure between 3 and 5 servers (NTP support pages recommend at least 4 or 5), or a pool. If only one server is configured, it will be believed, and if 2 servers are configured and they disagree, neither will be believed. Options:
    Prefer - NTP should favor the use of this server more than all others.
    No Select - NTP should not use this server for time, but stats for this server will be collected and displayed.
    Is a Pool - this entry is a pool of NTP servers and not a single address. This is assumed for *.pool.ntp.org."


  • Rebel Alliance

    Well that is not working since its not even resolving any hosts in the pool. So it doesn't even know to ask any ntp server for time.

    See how I have a placeholder, and then IPs listed under that.

    I would validate that pfsense is able to resolve.. You can use the dns lookup tool under diag to check if pfsense can resolve that FQDN.. See example below

    0_1528991100395_ntpresolving.png


  • Banned

    @NogBadTheBad I've already done that too with the same results.0_1528991697118_Capture02.JPG


  • Rebel Alliance

    Ok so your resolving, but ntp not able to reach or is not resolving? Place a specific IP in there vs FQDN.

    What do you have listed for interface that ntp is listening on? There was a recent there were a user was seeing a problem that ntp could not query unless they selected the wan interface. Even though that should not be required, unless you had maybe messed with your outbound nat.

    Are you trying to force all traffic through a vpn? your doing something odd with pfsense dns for sure since the only IP listed in pfsense for using the unbound resolver is the loopback, like you see in my output. But your also listing opendns.


  • Banned

    @johnpoz I am not sure why 0.north-america.pool.ntp.org was cut off in the Status/NTP section but it was configured correctly in the NTP config and it resolves perfectly fine.

    0_1528991917838_Capture04.JPG


  • Galactic Empire

    @brunovic

    [2.4.3-RELEASE][admin@pfsense]/root: ntpq -pn
         remote           refid      st t when poll reach   delay   offset  jitter
    ==============================================================================
     0.pool.ntp.org  .POOL.          16 p    -   64    0    0.000    0.000   0.000
     1.pool.ntp.org  .POOL.          16 p    -   64    0    0.000    0.000   0.000
     2.pool.ntp.org  .POOL.          16 p    -   64    0    0.000    0.000   0.000
     3.pool.ntp.org  .POOL.          16 p    -   64    0    0.000    0.000   0.000
    -2a01:7e00::f03c 85.199.214.98    2 u  334  512  377   10.483   -0.018   0.166
    +185.182.62.7    85.199.214.102   2 u   92  512  377    9.679   -0.223   0.409
    *87.242.168.84   .UPPS.           1 u  133  512  377   20.003    0.220   0.106
    -2001:1b40:5000: 188.39.213.7     2 u  324  512  377   10.234    2.004   0.296
    -83.137.225.103  193.190.230.66   2 u  199  512  377   10.425    0.849   0.296
    +188.39.213.7    .GPS.            1 u  432  512  377   16.887    0.036   4.039
    [2.4.3-RELEASE][admin@pfsense]/
    

    0_1528991888081_Untitled.jpeg

    Works fine here, I know thats not of any help.


  • Banned

    These are the results when I put the IP addresses directly in. Where do I find out what interface NTP is listening on?

    0_1528992318854_Capture05.JPG

    0_1528992358185_Capture06.JPG



  • Here's a link to my thread (that johnpoz mentioned) on the same problem:

    https://forum.netgate.com/topic/131506/ntp-not-working-solved-mostly

    For me, I have to have WAN selected under Services > NTP in the Interfaces section. I've been utterly unable to find any reason for this since it shouldn't be necessary.


  • Banned

    @beremonavabi said in Time is not syncing:

    Here's a link to my thread (that johnpoz mentioned) on the same problem:

    https://forum.netgate.com/topic/131506/ntp-not-working-solved-mostly

    For me, I have to have WAN selected under Services > NTP in the Interfaces section. I've been utterly unable to find any reason for this since it shouldn't be necessary.

    This solution worked for me. Thank you.

    0_1528992756723_Capture07.JPG



  • @brunovic
    I don't like having my WAN selected for NTP to listen to. But, since that's the only way I've found to be able to get NTP to run, I guess I have to live with it.


  • Galactic Empire

    @beremonavabi

    Does it now work ?

    You both shouldn't need to have it listening on the WAN interface.


  • Banned

    @johnpoz so it looks like my outbound NAT is manually configured. How will this prevent NTP from syncing?

    0_1528993260522_Capture08.JPG



  • @nogbadthebad said in Time is not syncing:

    @beremonavabi

    Does it now work ?

    You both shouldn't need to have it listening on the WAN interface.

    NTP will ONLY run on my SG-4860 if WAN is selected to listen to (the gory details of everything I've tried are in the thread I referenced, above). I agree that the WAN shouldn't be necessary. But, for no reason I can come up with, it turns out to be necessary in my case.

    Looking over some of brunovic's other posts, it looks like he's using a VPN. I am, too. It's possible that's a relationship, but I just don't see why using a VPN might interfere with NTP.


  • Banned

    @beremonavabi I use a VPN for remote access into my network but not for outbound traffic. Is that how you are using it?


  • Galactic Empire

    @beremonavabi said in Time is not syncing:

    @nogbadthebad said in Time is not syncing:

    @beremonavabi

    Does it now work ?

    You both shouldn't need to have it listening on the WAN interface.

    NTP will ONLY run on my SG-4860 if WAN is selected to listen to (the gory details of everything I've tried are in the thread I referenced, above). I agree that the WAN shouldn't be necessary. But, for no reason I can come up with, it turns out to be necessary in my case.

    Looking over some of brunovic's other posts, it looks like he's using a VPN. I am, too. It's possible that's a relationship, but I just don't see why using a VPN might interfere with NTP.

    I run a IKEv2 IPsec VPN ( inbound ) too I've got Automatic outbound NAT rule generation set.



  • @brunovic I've got OpenVPN clients running on my pfSense box to my VPN provider (AirVPN). I've also got a server running on it so our phones can use the VPN.


  • Banned

    @beremonavabi ah no I am not using the client on my pfsense just the server.



  • @brunovic said in Time is not syncing:

    @beremonavabi ah no I am not using the client on my pfsense just the server.

    Well, an OpenVPN server commonality might be a start. Mine is listening on port 443. My firewall rules on the WAN look like:

    0_1528994663634_20180604 -- Firewall Rules WAN.PNG

    Like you, my NAT rules are Manual. Outside of your specific ports, mine look similar:

    0_1528994721603_20180610 -- pfSense Firewall NAT Outbound.PNG

    For DNS, I’m using DNS Resolver in NON-Forwarding mode. It’s active for all my local LAN-type interfaces (not WAN). Though, since I've checked with NTP using actual IP addresses instead of pool names (as you did), I can't see how this could be DNS related.


  • Rebel Alliance

    @beremonavabi said in Time is not syncing:

    NTP will ONLY run on my SG-4860 if WAN is selected to listen

    I have sg4860, I run both vpn servers on multiple instances 443 tcp, 1194 udp and also a vpn client connection to a vps out on the net running openvpn-as..

    But I am NOT pulling routes from that connection and only policy route out to that vpn if need a client to take that path.. And I am NOT listening on the wan port and have zero issues with ntp talking to outbound ntp per previous screen shots.

    So you clearly have something messed up in your configuration causing this problem there is zero reason that ntp should have to listen on wan to talk to ntp servers on the internet.



  • @johnpoz said in Time is not syncing:

    @beremonavabi said in Time is not syncing:

    NTP will ONLY run on my SG-4860 if WAN is selected to listen

    I have sg4860, I run both vpn servers on multiple instances 443 tcp, 1194 udp and also a vpn client connection to a vps out on the net running openvpn-as..

    But I am NOT pulling routes from that connection and only policy route out to that vpn if need a client to take that path.. And I am NOT listening on the wan port and have zero issues with ntp talking to outbound ntp per previous screen shots.

    So you clearly have something messed up in your configuration causing this problem there is zero reason that ntp should have to listen on wan to talk to ntp servers on the internet.

    I'm also not pulling routes. I'm mostly clueless about this, but my routes look fine, to me:

    IPv4 Routes
    Destination	Gateway	Flags	Use	Mtu	Netif	Expire
    0.0.0.0/1	10.4.0.1	UGS	16952	1500	ovpnc1	
    default		[my WAN IP]	UGS	34	1500	igb1	
    10.4.0.0/16	10.4.0.1	UGS	0	1500	ovpnc1	
    10.4.0.1	link#12	UH	371622	1500	ovpnc1	
    10.4.0.14	link#12	UHS	0	16384	lo0	
    10.8.0.0/16	10.8.0.1	UGS	0	1500	ovpnc2	
    10.8.0.1	link#13	UH	371535	1500	ovpnc2	
    10.8.0.27	link#13	UHS	0	16384	lo0	
    [my WAN net]/24	link#2	U	371654	1500	igb1	
    [my WAN IP]	link#2	UHS	0	16384	lo0	
    127.0.0.1	link#7	UH	6821	16384	lo0	
    128.0.0.0/1	10.4.0.1	UGS	84534	1500	ovpnc1	
    192.168.1.0/24	link#1	U	0	1500	igb0	
    192.168.1.1	link#1	UHS	0	16384	lo0	
    192.168.10.0/24	link#3	U	0	1500	igb2	
    192.168.10.1	link#3	UHS	0	16384	lo0	
    192.168.20.0/24	link#4	U	10946342	1500	igb3	
    192.168.20.1	link#4	UHS	0	16384	lo0	
    192.168.30.0/24	link#5	U	464495	1500	igb4	
    192.168.30.1	link#5	UHS	0	16384	lo0	
    192.168.40.0/24	link#6	U	0	1500	igb5	
    192.168.40.1	link#6	UHS	0	16384	lo0	
    192.168.200.0/24	192.168.200.2	UGS	333989	1500	ovpns3	
    192.168.200.1	link#11	UHS	743340	16384	lo0	
    192.168.200.2	link#11	UH	33730	1500	ovpns3	
    [VPN address]/32	[my WAN IP]	UGS	456678	1500	igb1	
    [VPN address]/32	[my WAN IP]	UGS	5024988	1500	igb1	
    
    

    EDIT: Since only a handful of us have had this issue, I agree that I must have something messed up in my configuration. But I have no idea what it is. And, since nothing in my logs leaps out at me as being a problem, I don't even know where to look. I've pretty much given up on this and am just living with NTP on WAN.


  • Rebel Alliance

    @beremonavabi said in Time is not syncing:

    0.0.0.0/1 10.4.0.1 UGS 16952 1500 ovpnc1

    No your pulling routes if you have something like that..

    You blocked routes from your client config? See how have only my wan default route and only routes for my client connection are the network its connected too.0_1529004862429_notpull.png



  • @johnpoz I've got the same "Don't pull routes" box checked in my VPN clients. The 0.0.0.0/1 (and the 128.0.0.0/1) routes are added with the "redirect-gateway def1" Custom Option I'm using. That redirects all my traffic through the VPN (whereas you are policy routing specific clients), but leaves the default route untouched so the firewall, itself, can get through the WAN:

    https://forum.netgate.com/topic/115760/firewall-traffic-needs-redirect-gateway-def1-to-route-thru-vpn

    That being said, I had also been wondering if that could be causing the issue. But, since the OP of this thread isn't using a VPN client on pfSense, he shouldn't have those routes set. So, if that were the problem, he shouldn't be seeing it. Also, from my other thread I referenced earlier, I'm pretty sure that's what I tried to work around with a specific Outgoing NAT rule to allow UDP 123 traffic to go through the WAN:

    0_1529006304514_20180610 -- pfSense NTP Fix Question.PNG

    That didn't work. So, obviously it didn't do what I thought it might.

    Still, that's all on the routing side. I still don't understand why having NTP listen on the WAN would allow this to work. AFAIK, the NTP client on pfSense sends out traffic asking for the time and gets a response. There shouldn't be anything legitimate arriving unsolicited from the internet. So, the incoming NTP traffic ought to get right through the firewall since it's in response to a legitimate request.

    Do you have any blocking rules on your WAN to block incoming private/bogon networks? Or, do you just let the default "block everything" behavior in pfSense handle that? Could the NTP traffic from my setup be somehow avoiding NAT, going out with my private address on it, and getting blocked on the way back in by my rules?


  • Rebel Alliance

    @beremonavabi said in Time is not syncing:

    Custom Option I’m using.

    Same problem then... Why would you be doing that.. Turn that off - does your ntp start working now... Its quite possible your vpn is just blocking ntp. Sniff on your vpn interface do you see the ntp queries go out?

    Argghhh I wish people would stop jumping into threads that have NOTHING to do with their problem or their setup is completely different..



  • @johnpoz said in Time is not syncing:

    Argghhh I wish people would stop jumping into threads that have NOTHING to do with their problem or their setup is completely different..

    What are you talking about? I "jumped" into this thread and gave the OP the solution he needed to get NTP working (select the WAN in Services > NTP). I then noted he was using VPN, as was I. That's a point in common. I was trying to explore that as possibly relating to this issue. In what way did I jump in with something not related to the problem?

    But, I guess, just forget it.


  • Rebel Alliance

    @beremonavabi said in Time is not syncing:

    (select the WAN in Services > NTP)

    That is NOT a solution... That is a work around for some other misconfig..

    Did you do what I suggested and remove the 0.0.0.0 route you have and see if works then not picking wan.


  • Banned

    So to follow up on my issue which may be different from beremonavabi's. When I have the NTP interfaces set to internal interfaces I am unable to sync with NTP servers however when I ping I can get to them just fine. But when I selected WAN interface for NTP I am able to sync with the NTP servers. What could be causing that?


  • Banned

    Also under NTP what does selecting those interfaces even mean? How does it "listen" on those interfaces for NTP? Does it just mean that it sources the interface IPs? That part right there really confuses me.



  • NTP is 100% UDP and with UDP your application (in this case the NTP service) is responsible for both sending out the queries and listening for replies. This is completely unlike compared to TCP where TCP does all the heavy lifting for you with setting up the connection and dealing with the return traffic. The consquence of this is that any application using a UDP based protocol has to listen on a socket to do anything, even if it's just a client querying other servers.


  • Banned

    This post is deleted!

  • Banned

    @kpa said in Time is not syncing:

    NTP is 100% UDP and with UDP your application (in this case the NTP service) is responsible for both sending out the queries and listening for replies. This is completely unlike compared to TCP where TCP does all the heavy lifting for you with setting up the connection and dealing with the return traffic. The consquence of this is that any application using a UDP based protocol has to listen on a socket to do anything, even if it's just a client querying other servers.

    Okay. That doesn't answer my question though. My questions are:

    1. Why does it sync on WAN but not on any of the internal interfaces
    2. What does it mean by it is "listening" on those interfaces. I need to know from a routing perspective. I've done a ping sourcing those interfaces and pings from LAN, GUEST, etc come back with 0% packet loss. So if what you are telling me is true IF NTP is listening on though interfaces then UDP should not have a problem IF ICMP is fine.


    1. Post your outbound NAT configuration, if WAN is deselected from the interfaces the NTP service might be trying to bind to another interface but the outgoing connections fail because of faulty outbound NAT settings.

    2. It means literally what it says, listening for incoming data packets on the said interface. UDP is connectionless and stateless, an application that uses the UDP socket sends out a data packet (or multiples depending on the protocol) and then stops in listening mode to wait for the replies to the sent packets. Once those are received the data is processed and the loop starts again by either sending out more data or staying in listening mode for more incoming packets.


  • Banned

    @brunovic said in Time is not syncing:

    @johnpoz so it looks like my outbound NAT is manually configured. How will this prevent NTP from syncing?

    0_1528993260522_Capture08.JPG

    This is what you are looking for right?


  • Banned

    @kpa if that is the case then why would it be listening to NTP packets on the LAN and not the WAN? That server is not on my internal network.


  • Galactic Empire

    @brunovic

    Your router can provide ntp to clients on your lan, that’s why it listens on the lan interface.

    Have a look at the dhcp settings for your lan subnet.


  • Rebel Alliance

    Why do you have it in manual mode if all you doing is what automatic would be doing?

    Where is your nat for vpn connections, your tunnel network would need to be natted? Try changing it to automatic.. You sure and the hell should not have to listen on wan to query a time server.


  • Banned

    @johnpoz said in Time is not syncing:

    Why do you have it in manual mode if all you doing is what automatic would be doing?

    Where is your nat for vpn connections, your tunnel network would need to be natted? Try changing it to automatic.. You sure and the hell should not have to listen on wan to query a time server.

    There is a reason to it. I can't remember but something was not working correctly in automatic mode.


  • Rebel Alliance

    Like what? Put it back.. And delete all your manual rules. You can always put it back to manual if this whatever it is comes back.. But if there is something that is not working in automatic mode that should be brought up so we can fix it, so other users using automatic don't have whatever this is issue is you think you were having.


Locked
 

© Copyright 2002 - 2018 Rubicon Communications, LLC | Privacy Policy