NTP Server not synchronizing if localhost selected
-
@tjsober yeah I was going to try and duplicate your problem. But I have loads of ntp traffic back and forth since I provide a ntp server to the ntp pool. I would have to block my ntp server from answering, etc. Or it would be hard to weed through all the ntp traffic.
But I don't see any 127.0.0.1 as source traffic there.. So doesn't seem like pfsense is not natting to yoru public IP even when localhost is selected?
edit: But what I did do is just select localhost, and then pointed it to pool.ntp.org and that seems to be broken.
edit2: If I select the local interfaces I want to provide time to, and localhost - its seems to be working
edit3: Why are you wanting to select localhost? I don't really see a reason to do that, other than you would think it should be fine to do..
-
@johnpoz I figured something out. I disabled pfBlockerNG and restarted NTP Server with localhost selected in the NTP settings. And guess what? NTP syncs fine.
Then I turned pfblocker back on and NTP continued to sync. So I restarted the NTP server and it broke.
I found this because put in some rules to lock down NTP so the linux boxes couldn't reach out and repeated the packet capture. And the IP that showed up in the capture was 10.10.10.1... the pfBlocker VIP. That's not going to work!
Isn't it always what is left out of the problem description that is the issue...and I tried to be complete :)
I have to start looking at pfblocker to see how it is messing with localhost or why the NTP server is trying to sync using the pfblocker VIP. That's probably going to be a can of worms. Interestingly, it should be configured the same as the SG-5100 where I don't have this issue. But I'll have to look closer as there are some differences (currently no VLAN's on the SG5100 for example).
I still don't understand why the port forward rule in the post I originally linked fixes this. And I am back to wondering if anything matters if localhost isn't bound to the NTP server. The rabbit hole just keeps getting deeper.
Thank you so much for taking the time to teach me some things. Your patience is appreciated.
-
@tjsober said in NTP Server not synchronizing if localhost selected:
10.10.10.1... the pfBlocker VIP. That's not going to work!
nope that wouldn't work ;) hmmm I would have to change back and sniff to see if have same thing.. But I am not using pfblocker in that fashion, I have no vip setup with it. I just use it to manipulate some aliases that I use in my firewall.
Rabbit holes can be fun, if you ever get to the end.. Other times they can be real head scratchers ;)
edit: see I don't have that feature enabled in pfblocker
It shouldn't be creating that vip if I don't have that enabled - have to take a double check look see.
edit2: I just looked and there is no vip on my loopback interface.. I do see my other vip on my wan interface, etc. But no 10.10.10.1 anywhere on any interface..
-
@tjsober said in NTP Server not synchronizing if localhost selected:
I still don't understand why the port forward rule in the post I originally linked fixes this.
Probably because 'This firewall' is all IPs addresses on the firewall, including VIPs.
-
@johnpoz Under pfBlockerNG - DNSBL if I change the Web Server Interface from Localhost to my LAN with high numbered unused ports, the problem is fixed. Likely because the LAN is handled by the outgoing NAT auto rules.
Oddly, the SG-5100 doesn't seem to care about that setting and the NTP server just works.
More homework to do...
EDIT: What I said doesn't make sense to me. It doesn't explain why NTP is picking localhost as the outgoing port? It only identifies some interaction with pfBlocker.
-
@johnpoz @johnpoz The last comments in this post from 4 years ago seem to discuss this same problem.
https://www.reddit.com/r/PFSENSE/comments/7k00yz/dnsbl_blocks_ntp_server_from_syncing/
But I do not understand why NTP decides to bind to the pfblocker VIP. So more googling and I found a person talking about NTP
https://www.reddit.com/r/pfBlockerNG/comments/kfnujp/avahi_binding_to_the_virtual_ip_of_pfblockerng/
So I shut off Avahi and set pfblocker back to localhost and all is well. I re-enabled avahi, restarted NTP and it's broken again. More googling...but I guess this is progress.
-
@tjsober and down the rabbit hole you go ;)
-
@tjsober said in NTP Server not synchronizing if localhost selected:
But I do not understand why NTP decides to bind to the pfblocker VIP.
Probably because it's the lowest available source IP as you said previously.
-
@stephenw10 Does "lowest" mean IP? Because I tried changing the VIP from 10.10.10.1 to 192.168.250.250 (above any of the IP subnets) and the behavior is the same.
-
@johnpoz So I think I can ignore avahi. I was watching as I did a force reload on pfblocker and even though I picked localhost for the web server interface, it still thinks it is on the lan high ports. So it was fooling me because the configuration wasn't changing to localhost. I'm going to uninstall pfblocker and start from scratch.
What a way to waste a day...
-
OK...I'm stopping. Apparently the pfBlocker VIP and Web Server Interface ports were "sticking" and after several changes and Force Updates I got the DNSBL Webserver ports to change to 80 and 443 on localhost and set the VIP from 10.10.10.1 to 192.168.254.254. Everything seems to be working... NTP with localhost and not WAN selected syncs, Avahi is happy (that was a red herring), and pfBlocker is working.
It all seems to come down to, for some reason that I don't know, on this firewall NTP binds to the VIP because it is lower, where as on the SG-5100 NTP ignores the VIP even though it is also lower.
Thank you for your patience and all of the assistance.
Edit: I figured out why the SG-5100 works... It has a VPN server at 10.3.x.x, BELOW the DNSBL VIP of 10.10.10.1. Whereas the VP2410 VPN is at 10.42.x.x, ABOVE the DNSBL IP. This was the difference all along and it is the VPN IP that NTP is now syncing to on both systems.