• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Is it possible to serve time for Windows?

Scheduled Pinned Locked Moved Off-Topic & Non-Support Discussion
11 Posts 9 Posters 2.5k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • D
    dimskraft
    last edited by Jun 27, 2019, 5:05 PM

    Is it possible to serve time for Windows?

    I can set time.windows.com and have Windows automatically synchronize time with Internet. But if I set IP address of pfSense box, Windows is unable to sync.

    Is it possible to set up on server side?

    1 Reply Last reply Reply Quote 0
    • V
      viragomann
      last edited by viragomann Jun 27, 2019, 5:19 PM Jun 27, 2019, 5:15 PM

      Is the NTP service configured on pfSense (Services > NTP)?

      Why do you think, Windows doesn't sync?
      Try

      w32tm /stripchart /computer:<pfSense IP>
      

      Also ensure that access to pfSense UDP/123 is permitted.

      1 Reply Last reply Reply Quote 0
      • J
        JeGr LAYER 8 Moderator
        last edited by Jun 28, 2019, 3:00 PM

        Also check for some AD dark magic that sets Windows to a setting that won't work with standard-NTP servers. There was something about SNTP servers I remember vaguely that made it incompatible with normal running default NTP. Resetting that via an AD directive to "normal" NTP fixed it. Normally SNTP and NTP aren't incompatible but somehow our Windows DC didn't "understand" that ;)

        Don't forget to upvote 👍 those who kindly offered their time and brainpower to help you!

        If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

        1 Reply Last reply Reply Quote 0
        • P
          provels
          last edited by provels Jun 29, 2019, 12:07 AM Jun 29, 2019, 12:06 AM

          I tried it for a while, but it seemed to fail more than it succeeded (workgroup only). Even NTP for the FW itself would fail at times. Nothing wrong with time.windows,com. Always works.

          Peder

          MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
          BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

          1 Reply Last reply Reply Quote 0
          • J
            johnpoz LAYER 8 Global Moderator
            last edited by Jun 29, 2019, 12:36 AM

            @provels said in Is it possible to serve time for Windows?:

            Nothing wrong with time.windows,com. Always works.

            Not true at all... Back in 2017 there was a massive issue where it was sending out the wrong time ;)

            Even NTP for the FW itself would fail at times

            Well where were you pointing it - pool? Or time.windows.com???

            NTP is rock solid protocol.. And just works - unless you have something blocking it or some serious network issues. I always just replace the built in windows time stuff with the official ntp client..

            Out of the box pretty sure windows before 10 just used sntp, and you need to make some reg changes if you want it to actually use nt with the built in stuff. But a sntp client can get time from any ntp server - its just how it works that is different.

            What flavor of windows are you running? But yeah if you want to use pfsense - you need to validate its ntp is actually running and working, and you have firewall rules to allow access to it.

            If you want to use the actual ntp client for windows you can grab copy here
            https://www.meinbergglobal.com/english/sw/ntp.htm#ntp_stable

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • Q
              q54e3w
              last edited by q54e3w Jun 29, 2019, 7:22 AM Jun 29, 2019, 7:18 AM

              Heres how I configure my Server 2016/2019 boxes with pfSense NTP server.

              On fresh boot syncs with time.microsoft.com

              w32tm /query /status
              
              Leap Indicator: 0(no warning)
              Stratum: 3 (secondary reference - syncd by (S)NTP)
              Precision: -23 (119.209ns per tick)
              Root Delay: 0.0843484s
              Root Dispersion: 0.0506468s
              ReferenceId: 0x34ADC1A6 (source IP:  __52.173.193.166__)
              Last Successful Sync Time: 6/23/2019 7:15:05 PM
              Source: time.windows.com,0x8
              Poll Interval: 10 (1024s)
              

              set IP address to pfSense NTP server

              w32tm /config /manualpeerlist:192.168.10.1 /syncfromflags:MANUAL
              

              stop and start the time service

              stop-service w32time
              start-service w32time
              

              give it s few moments and verify its syncing correctly.

              w32tm /query /status
              
              Leap Indicator: 0(no warning)
              Stratum: 3 (secondary reference - syncd by (S)NTP)
              Precision: -23 (119.209ns per tick)
              Root Delay: 0.0006681s
              Root Dispersion: 7.7694645s
              ReferenceId: 0xC0A80A01 (source IP:  192.168.10.1)
              Last Successful Sync Time: 6/23/2019 7:17:54 PM
              Source: 192.168.10.1
              Poll Interval: 6 (64s)
              

              and after some time it will be more accurate

              w32tm /query /status
              Leap Indicator: 0(no warning)
              Stratum: 3 (secondary reference - syncd by (S)NTP)
              Precision: -23 (119.209ns per tick)
              Root Delay: 0.0004008s
              Root Dispersion: 0.0414628s
              ReferenceId: 0xC0A80A01 (source IP:  192.168.10.1)
              Last Successful Sync Time: 6/29/2019 12:18:32 AM
              Source: 192.168.10.1
              Poll Interval: 9 (512s)
              
              1 Reply Last reply Reply Quote 0
              • J
                JeGr LAYER 8 Moderator
                last edited by Jul 1, 2019, 2:15 PM

                No problems here either after reconfiguring AD with changes to (S)NTP it was working rock solid as always.

                Don't forget to upvote 👍 those who kindly offered their time and brainpower to help you!

                If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

                1 Reply Last reply Reply Quote 0
                • M
                  Margod
                  last edited by May 15, 2023, 2:00 PM

                  I'd recommend check if your pfSense is set to provide NTP services. Head over to the "Services" menu, then hit "NTP." Make sure it's enabled, and you're good to go.

                  1 Reply Last reply Reply Quote 0
                  • S
                    Stevenadry
                    last edited by May 15, 2023, 7:17 PM

                    To get your Windows syncing with a pfSense box, there might be a couple of things you need to check. First, make sure the NTP server is properly configured on your pfSense box. Then, check your firewall rules to ensure that the NTP traffic isn't being blocked.

                    1 Reply Last reply Reply Quote 0
                    • J
                      JonathanLee
                      last edited by May 15, 2023, 7:49 PM

                      Yes I do. I do it by way of NAT port forwarding so it redirects to the firewall.

                      7137ae6f-3513-4276-b271-6f12769023cb-image.png
                      (NAT RULE)

                      de641522-6cef-45d6-80ec-260117415fd4-image.png
                      (NAT port forwarding)

                      My system serves time via encrypted connection to NIST.
                      c29eb62b-e682-4241-817a-f5482affe2ad-image.png

                      Now anything on the network goes to the firewall for time.

                      Make sure to upvote

                      1 Reply Last reply Reply Quote 0
                      • J
                        JonathanLee
                        last edited by May 15, 2023, 7:51 PM

                        This way it does not matter what requests it sends out the firewall responds

                        19c8170c-fbb0-4529-aeee-02638e2ded94-image.png

                        Devices get requests sent to the firewall transparently, no more 1980s NTP protocol issues this way.

                        Make sure to upvote

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                          [[user:consent.lead]]
                          [[user:consent.not_received]]