NTP Issue

ARAMP1

I have what is basically a pi based stratum 1 NTP server with a GPS antenna on top of my house that's been going for the last 5 or 6 years. I've basically directed all traffic on my network to it, however it seemingly became unreachable right around the time I updated to release 2.7.1. Of course I don't know if this is a 2.7.1 issue or it just randomly happened at the same time. It remained when I upgraded to 2.7.1.

Unreach/Pending

I'm able to ping the NTP server and pull up it's GUI. It seems to be working as advertised, obtaining GPS satellites with a broadcast interval of 10ms, however pfSense shows the status as "Unreach/Pending". I'm kind of at a loss here of how to begin to troubleshoot. Any ideas?

conover

@ARAMP1 sounds like the same issue I have with the plus version 23.09:

https://forum.netgate.com/post/1136805

NTP works again going back to previous version (23.05.01)

kiokoman

@ARAMP1
i don't have any trouble with my stratum 1 NTP server.. anyway do you have the network of your ntp server configured in the ACLs tab perhaps ?

i don't remember why i have it populated... maybe for the same problem long time ago ...

conover

@kiokoman said in NTP Issue:

@ARAMP1
i don't have any trouble with my stratum 1 NTP server.. anyway do you have the network of your ntp server configured in the ACLs tab perhaps ?

i don't remember why i have it populated... maybe for the same problem long time ago ...

Tried that (with my IP addresses :-) ), no change for me (23..09)

But I also got the response that most people don't have problems with their own stratum 1 servers.
Must be a combination of several factors (including the most current version, since NTP works on the previois version with exactly the same config)).

ARAMP1

@conover said in NTP Issue:

@ARAMP1 sounds like the same issue I have with the plus version 23.09:

https://forum.netgate.com/post/1136805

NTP works again going back to previous version (23.05.01)

Just read through your thread. Seems like the the exact same issue, or the exact same result...whatever it is. I might revert back to 2.7.1 or even 2.7.0 when the wife and kids are out of the house just to check it.

ARAMP1

@kiokoman said in NTP Issue:

@ARAMP1
i don't have any trouble with my stratum 1 NTP server.. anyway do you have the network of your ntp server configured in the ACLs tab perhaps ?

i don't remember why i have it populated... maybe for the same problem long time ago ...

I didn't. I added it though but no change.

stephenw10

@ARAMP1 said in NTP Issue:

I'm able to ping the NTP server and pull up it's GUI.

This seem more like some general connectivity issue and not specifically NTP related.

How is the NTP server connected? How are the clients you're testing from connected? Do you see blocked traffic?

ARAMP1

@stephenw10 said in NTP Issue:

@ARAMP1 said in NTP Issue:

I'm able to ping the NTP server and pull up it's GUI.

This seem more like some general connectivity issue and not specifically NTP related.

How is the NTP server connected? How are the clients you're testing from connected? Do you see blocked traffic?

Everything is connected via ethernet. No blocked traffic that I can tell.

stephenw10

Sorry I mean is everything on the same subnet? Same interface in pfSense? Or is pfSense routing that traffic maybe?

ARAMP1

Ah, the NPT server is on a management VLAN where I keep all my switches, access points, IPMI addresses, etc. I'm able to access it from my other VLANs though.

stephenw10

Oh wait I misread that as 'unable' to access. Ignore me!

kiokoman

@ARAMP1
can you try this?

[23.09.1-RELEASE][root@pfSense.kiokoman.home]/root: ntpdate -4 -d 192.168.10.200
11 Dec 19:02:31 ntpdate[90565]: ntpdate 4.2.8p17@1.4004-o Fri Oct  6 04:49:28 UTC 2023 (1)
transmit(192.168.10.200)
receive(192.168.10.200)
transmit(192.168.10.200)
receive(192.168.10.200)
transmit(192.168.10.200)
receive(192.168.10.200)
transmit(192.168.10.200)
receive(192.168.10.200)

server 192.168.10.200, port 123
stratum 1, precision -20, leap 00, trust 000
refid [GPS], root delay 0.000000, root dispersion 0.050781
reference time:      e921cd07.c6d512e4  Mon, Dec 11 2023 19:01:43.776
originate timestamp: e921cd3d.75978b8d  Mon, Dec 11 2023 19:02:37.459
transmit timestamp:  e921cd3d.75888e26  Mon, Dec 11 2023 19:02:37.459
filter delay:  0.02597    0.02596    0.02596    0.02927
               ----       ----       ----       ----
filter offset: -0.000026  -0.000005  -0.000060  -0.001640
               ----       ----       ----       ----
delay 0.02596, dispersion 0.00021, offset -0.000005

11 Dec 19:02:37 ntpdate[90565]: adjust time server 192.168.10.200 offset -0.000005 sec

change the ip with your ntp server

ARAMP1

@kiokoman said in NTP Issue:

@ARAMP1
can you try this?

[23.09.1-RELEASE][root@pfSense.kiokoman.home]/root: ntpdate -4 -d 192.168.10.200
11 Dec 19:02:31 ntpdate[90565]: ntpdate 4.2.8p17@1.4004-o Fri Oct  6 04:49:28 UTC 2023 (1)
transmit(192.168.10.200)
receive(192.168.10.200)
transmit(192.168.10.200)
receive(192.168.10.200)
transmit(192.168.10.200)
receive(192.168.10.200)
transmit(192.168.10.200)
receive(192.168.10.200)

server 192.168.10.200, port 123
stratum 1, precision -20, leap 00, trust 000
refid [GPS], root delay 0.000000, root dispersion 0.050781
reference time:      e921cd07.c6d512e4  Mon, Dec 11 2023 19:01:43.776
originate timestamp: e921cd3d.75978b8d  Mon, Dec 11 2023 19:02:37.459
transmit timestamp:  e921cd3d.75888e26  Mon, Dec 11 2023 19:02:37.459
filter delay:  0.02597    0.02596    0.02596    0.02927
               ----       ----       ----       ----
filter offset: -0.000026  -0.000005  -0.000060  -0.001640
               ----       ----       ----       ----
delay 0.02596, dispersion 0.00021, offset -0.000005

11 Dec 19:02:37 ntpdate[90565]: adjust time server 192.168.10.200 offset -0.000005 sec

change the ip with your ntp server

Here's what I get:

11 Dec 13:42:23 ntpdate[40581]: ntpdate 4.2.8p17@1.4004-o Fri Nov 17 14:48:54 UTC 2023 (1)
transmit(192.168.10.120)
receive(192.168.10.120)
transmit(192.168.10.120)
receive(192.168.10.120)
transmit(192.168.10.120)
receive(192.168.10.120)
transmit(192.168.10.120)
receive(192.168.10.120)

server 192.168.10.120, port 123
stratum 1, precision -18, leap 00, trust 000
refid [PPS], root delay 0.000000, root dispersion 0.000000
reference time: e921e4a5.00000000 Mon, Dec 11 2023 13:42:29.000
originate timestamp: e921e4a5.c5604188 Mon, Dec 11 2023 13:42:29.771
transmit timestamp: e921e4a5.c5f7503b Mon, Dec 11 2023 13:42:29.773
filter delay: 0.02501 0.02515 0.02541 0.02478
---- ---- ---- ----
filter offset: -0.002827 -0.002754 -0.002617 -0.002893
---- ---- ---- ----
delay 0.02478, dispersion 0.00009, offset -0.002893

11 Dec 13:42:29 ntpdate[40581]: adjust time server 192.168.10.120 offset -0.002893 sec

I see yours is showing GPS and mine is showing PPS

kiokoman

@ARAMP1
I think it's just a label or the way I configured my ntpsec, either way this shows that pfsense is able to communicate with your ntp server on port 123

the only way for me to have a Unreach/Pending state is when i select an isolated interface that is unable to reach my ntp server.
did you try to change the interface where it's listening? like localhost only ?

ARAMP1

@kiokoman said in NTP Issue:

did you try to change the interface where it's listening? like localhost only ?

Just tried that...no change.

ARAMP1

@conover said in NTP Issue:

@ARAMP1 sounds like the same issue I have with the plus version 23.09:

https://forum.netgate.com/post/1136805

NTP works again going back to previous version (23.05.01)

I just read through your thread again. I noticed that you were able to point specific machines to the IP address of your NTP server and bypass pfSense. I really want/need a windows machine that I run Blue Iris on and all of my security cameras to be synced, so I did that for that windows machine and it works fine.

JonathanLee

They have a Redmine open for NTP authentication issues I think the patch that Marcos and Matthew merged might also fix this. The GitHub was merged a couple days ago but has not been looked at but it looked to incorporate many fixes not just authentication issues.

https://redmine.pfsense.org/issues/8794

https://github.com/pfsense/pfsense/commit/847e417b5612f28bc1e84ca028a980df9c5c57a7

admacdo

@ARAMP1
Well, it's taken me quite a few hours to get to this post.
I went to check my time precision this morning and noticed that the graphs were all way out.
Checking when it started, it was right after I upgraded to 2.7.2.
Looking at my local Stratum 1 NTP server, it's pending/unreachable and the firewall has fallen back to time.apple.com

With the basics checked, then ACL's adjusted and even firewall rules put in, the ntpupdate -4 command showed that everything is working as it should. (And likely was before I did anything other than upgrade...)
pfsense just refuses to accept any NTP traffic from the LAN side of the house.
Right when I was starting to think it couldn't be much else than a system issue, I found this thread.
As well as confirming that some of us take time seriously, it was nice to know that we've got the same issue.

Looks like a roll back is in order, or just wait for the patch

ARAMP1

@admacdo said in NTP Issue:

Looks like a roll back is in order, or just wait for the patch

Even though there are issues with this (and also the ARP table showing permanent entries), I've decided to keep it at 2.7.2. I still show a stratum 1 using the nist.gov clocks. The only issue would be if the internet goes down. If it becomes an issue with individual machines, I'll direct them to my local NTP server then.

EricMc1

just to pile on one more, I have the same issue on 23.09.1 on two 6100s with a local TM2000 on the same lan. I tried all of the things mentioned in these threads with no changes. It looks like it broke on 23.09 for me as well (after reviewing the RRD after I noticed the issue).