Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    ntp only connecting to some time servers

    Scheduled Pinned Locked Moved General pfSense Questions
    28 Posts 3 Posters 2.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      nback
      last edited by

      ntp only connecting to some time servers

      I have ntp servers setup in pfsense to pools:
      status-ntp.png

      ntp.plus.net
      ntp.virginmedia.com
      0.uk.pool.ntp.org
      1.uk.pool.ntp.org
      2.uk.pool.ntp.org
      0.gentoo.pool.ntp.org
      1.gentoo.pool.ntp.org
      2.gentoo.pool.ntp.org
      3.gentoo.pool.ntp.org
      192.168.250.20 - a box on the lan

      the box on the lan successfully gets its sync from *.gentoo.pool.ntp.org

      However pfsense only manages to connect to ntp.plus.net and 192.168.250.20
      Why does pfsense only connect to these servers?
      If I remove ntp.plus.net and 192.168.250.20 it no longer connect to any time server.

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Check the ntp logs, you may need to enable more logging. Are all those entries marked as pools actually pools? I assume plus.net is if you are connecting to that. Is ntp.virginmedia.....

        Is the lan box and pfSense using the same DNS server(s)?

        Steve

        JKnottJ N 2 Replies Last reply Reply Quote 0
        • JKnottJ
          JKnott @stephenw10
          last edited by

          @nback

          Also, why so many pools and servers? You should have 3 or 4, some people say 5 or 6. Beyond that, you're not accomplishing much. All NTP servers are supposed to be traceable back to International Atomic Time. This means they'll all provide exactly the same time, within the limits of their precision. If you want a backup server, you need to connect to at least 3, so that if one produces bad data, it can be ignored. Beyond that, adding more severs accomplishes little.

          PfSense running on Qotom mini PC
          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
          UniFi AC-Lite access point

          I haven't lost my mind. It's around here...somewhere...

          N 1 Reply Last reply Reply Quote 0
          • N
            nback @stephenw10
            last edited by

            @stephenw10
            The lan box is using the pfsense firewall as its DNS server.
            https://www.petenetlive.com/KB/Article/0001154 indicates that plusnet is a pool with the IP's displayed in the ntp status image above. I don't know about ntp.virginmedia.com.
            I'll try turning on some ntp logs.

            N 1 Reply Last reply Reply Quote 0
            • N
              nback @JKnott
              last edited by

              @JKnott
              I used to just have pool.ntp.org as the ntp server. This stopped working some time ago. I only noticed after the pfsense time drifted by some hours. Resetting the time manually did not help, it just drifted again. Looking at the NTP status monitoring graph it appears the ntp stopping working around about 2019-11-05. In an attempt to diagnose the problem I added the lan box the the ntp server list. I my surprise it worked, so I added some more external ones, ending up with the list show above. Examining the backups of the pfsense xml config files, I could find nothing that changed around the time (2019-11-05) ntp stopped working.

              1 Reply Last reply Reply Quote 0
              • N
                nback @nback
                last edited by

                @nback
                Here is the ntp log after turning on logging. Hopefully I've obscured all sensitive IP addresses.
                ntp.log.txt
                This pfsense is dual wan, single lan in fail over mode.

                N 1 Reply Last reply Reply Quote 0
                • N
                  nback @nback
                  last edited by

                  @nback
                  Both WAN1 and WAN2 are with plusnet.

                  N 1 Reply Last reply Reply Quote 0
                  • N
                    nback @nback
                    last edited by

                    @nback
                    OK. I've tried pinging the ntp servers from the box on lan and ssh'ed into the pfsense shell.
                    ping-ntp-servers-from-box-on-lan-shell.txt
                    ping-ntp-servers-from-pfsense-shell.txt
                    From this it looks like the dns in pfsense is working OK but routing from 127.0.0.1 is failing for the unreachable ntp servers.
                    I've look and my pfsense config and logs but can not find the cause.
                    Any suggestions welcome.

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      Do you have complete outbound NAT rules from 127.0.0.1?
                      Any outbound block rules on the floating tab?

                      The TTL error looks more like a routing problem though, it's looping somewhere. Do you have a port forward for NTP traffic?

                      Steve

                      N 1 Reply Last reply Reply Quote 0
                      • N
                        nback @stephenw10
                        last edited by

                        @stephenw10
                        The only nat-outbound are auto but I don't understand what the ISAKMP rules are for.
                        nat-outbound.png
                        The floating tab is empty.
                        No port forward for NTP, grep <port>123 on the latest backup returns nothing.
                        I agree it feels like a routing problem but I don't understand why ntp.plus.net works or why all other external servers fail.

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          The ISAKMP rules are for clients behind pfSense using IPSec. Some servers require a fixed source port (usually also 500) so that rule does not change the source port for port 500 connections.

                          Let's see your routing table. Though if it's looping there I'd expect something very obviously wrong. And also other traffic to fail.

                          Steve

                          N 1 Reply Last reply Reply Quote 0
                          • N
                            nback @stephenw10
                            last edited by

                            @stephenw10
                            ipv4 and ipv6 routing tables. Hopefully I've obscured all sensitive IP addresses
                            netstat-ipv4.txt
                            netstat-ipv6.txt

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Nothing glaringly obvious there. Either it is looping or it's sending with a stupidly low TTL value.

                              Try a traceroute to one of those failing IPs from pfSense, you would see a loop there.

                              Check the state table or a packet capture, is it actually sending from one of the WANs?

                              On a side note you're lucky to have different gateways with two PPP connections to the same ISP. I use plusnet and have not been so lucky. 😉

                              Steve

                              N 1 Reply Last reply Reply Quote 0
                              • N
                                nback @stephenw10
                                last edited by

                                @stephenw10

                                On pfsense

                                traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 85.199.214.102
                                traceroute: findsaddr: failed to connect to peer for src addr selection
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 212.71.248.69
                                traceroute: findsaddr: failed to connect to peer for src addr selection.
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 138.68.183.179
                                traceroute: findsaddr: failed to connect to peer for src addr selection.
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 212.71.248.69
                                traceroute: findsaddr: failed to connect to peer for src addr selection.
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 178.62.250.107
                                traceroute: findsaddr: failed to connect to peer for src addr selection.
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 217.114.59.66
                                traceroute: findsaddr: failed to connect to peer for src addr selection.
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 138.68.183.179
                                traceroute: findsaddr: failed to connect to peer for src addr selection.
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 212.71.248.69
                                traceroute: findsaddr: failed to connect to peer for src addr selection.
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 178.62.250.107
                                traceroute: findsaddr: failed to connect to peer for src addr selection.
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 217.114.59.66
                                traceroute: findsaddr: failed to connect to peer for src addr selection.
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 138.68.183.179
                                traceroute: findsaddr: failed to connect to peer for src addr selection.
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 212.71.248.69
                                traceroute: findsaddr: failed to connect to peer for src addr selection.
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 178.62.250.107
                                traceroute: findsaddr: failed to connect to peer for src addr selection.
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 217.114.59.66
                                traceroute: findsaddr: failed to connect to peer for src addr selection.
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 138.68.183.179
                                traceroute: findsaddr: failed to connect to peer for src addr selection.
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 212.71.248.69
                                traceroute: findsaddr: failed to connect to peer for src addr selection.
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 178.62.250.107
                                traceroute: findsaddr: failed to connect to peer for src addr selection.
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 217.114.59.66
                                traceroute: findsaddr: failed to connect to peer for src addr selection.
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 138.68.183.179
                                traceroute: findsaddr: failed to connect to peer for src addr selection.
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 212.71.248.69
                                traceroute: findsaddr: failed to connect to peer for src addr selection.
                                [2.4.0-RELEASE][root@pfsense.local1]/root: traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 178.62.250.107
                                traceroute: findsaddr: failed to connect to peer for src addr selection.

                                I cleared the state table and tried again
                                traceroute 0.gentoo.pool.ntp.org
                                traceroute: Warning: 0.gentoo.pool.ntp.org has multiple addresses; using 134.0.16.1
                                traceroute: findsaddr: failed to connect to peer for src addr selection.

                                IP 134.0.16.1 does not appear in the state table. So I guess it's not sending.

                                From box on lan

                                traceroute to 0.gentoo.pool.ntp.org (129.250.35.250), 30 hops max, 60 byte packets
                                1 253.core.plus.net (195.166.130.253) 7.825 ms 7.805 ms 7.842 ms
                                2 84.93.253.107 (84.93.253.107) 8.455 ms 84.93.253.111 (84.93.253.111) 8.797 ms 8.741 ms
                                3 195.99.125.142 (195.99.125.142) 9.191 ms core1-BE1.southbank.ukcore.bt.net (195.99.125.130) 9.185 ms 195.99.125.138 (195.99.125.138) 8.722 ms
                                4 109.159.252.140 (109.159.252.140) 9.222 ms core4-hu0-8-0-0.faraday.ukcore.bt.net (195.99.127.52) 9.415 ms 9.953 ms
                                5 62.6.201.145 (62.6.201.145) 9.901 ms 9.440 ms 9.385 ms
                                6 166-49-209-194.eu.bt.net (166.49.209.194) 9.877 ms 8.754 ms 8.736 ms
                                7 * ae-1.r02.londen03.uk.bb.gin.ntt.net (129.250.4.148) 9.805 ms 9.530 ms
                                8 x.ns.gin.ntt.net (129.250.35.250) 8.553 ms !X 8.787 ms !X ae-1.r02.londen03.uk.bb.gin.ntt.net (129.250.4.148) 9.777 ms
                                traceroute 0.gentoo.pool.ntp.org
                                traceroute to 0.gentoo.pool.ntp.org (85.199.214.102), 30 hops max, 60 byte packets
                                1 253.core.plus.net (195.166.130.253) 7.847 ms 7.366 ms 7.360 ms
                                2 84.93.253.107 (84.93.253.107) 8.630 ms 84.93.253.111 (84.93.253.111) 8.301 ms 84.93.253.107 (84.93.253.107) 9.054 ms
                                3 195.99.125.142 (195.99.125.142) 8.607 ms core1-BE1.southbank.ukcore.bt.net (195.99.125.130) 9.040 ms 195.99.125.142 (195.99.125.142) 9.081 ms
                                4 peer7-et-3-1-6.telehouse.ukcore.bt.net (109.159.252.234) 9.279 ms peer7-et-3-1-5.telehouse.ukcore.bt.net (109.159.252.236) 9.119 ms peer7-et-4-1-5.telehouse.ukcore.bt.net (194.72.16.142) 9.983 ms
                                5 * * *
                                6 edge2.lon.uk.as61337.net (91.230.243.221) 9.282 ms 7.909 ms 7.897 ms
                                7 core1.blet.uk.as61337.net (91.230.243.226) 10.365 ms 9.857 ms 9.921 ms
                                8 core1.np.uk.as61337.net (91.230.243.42) 10.382 ms 10.434 ms 10.375 ms
                                9 * * *
                                10 * * *
                                11 * * *
                                12 * * *
                                13 * * *
                                14 * * *
                                15 * * *
                                16 * * *
                                17 * * *
                                18 * * *
                                19 * * *
                                20 * * *
                                21 * * *
                                22 * * *
                                23 * * *
                                24 * * *
                                25 * * *
                                26 * * *
                                27 * * *
                                28 * * *
                                29 * * *
                                30 * * *

                                I hadn't noticed the different gateways. I think they change on occasionally.

                                Norman

                                N 1 Reply Last reply Reply Quote 0
                                • N
                                  nback @nback
                                  last edited by

                                  @nback said in ntp only connecting to some time servers:
                                  If I clear the state table and ping 134.0.16.1 from pfsense I see:
                                  states-icmp-pfsense.png Nothing passed to WAN (or any other interface!)

                                  If I do the same from the box on the lan I see:
                                  states-icmp-box-on-lan-2.png

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Hmm, what interfaces do you have set for ntp? Try just unselecting any interfaces so it uses all interfaces.

                                    Steve

                                    N 1 Reply Last reply Reply Quote 0
                                    • N
                                      nback @stephenw10
                                      last edited by

                                      @stephenw10
                                      Was WAN,WAN2 and LAN. Originally just WAN amd WAN2 before I added the box on lan.
                                      Unselecting all interface made no difference to the issue. Just seeing all interfaces listened to in the NTP log. Nothing additional in the NTP status.

                                      N 1 Reply Last reply Reply Quote 0
                                      • N
                                        nback @nback
                                        last edited by

                                        @nback
                                        I meant to add that I then tried a reboot of pfsense but no change.

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          Hmm, why is it using localhost as source there....

                                          Did you actually choose localhost to ping from? It should still work but does it work if you choose WAN as source?

                                          Steve

                                          N 2 Replies Last reply Reply Quote 0
                                          • N
                                            nback @stephenw10
                                            last edited by nback

                                            This post is deleted!
                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.