NTP Issue

ARAMP1

packetcapture-ix1-20240602201708.pcap

johnpoz

@ARAMP1 this seems a bit odd

ARAMP1

@johnpoz I'm looking at wireshark now, but I don't know what I'm looking at.

ARAMP1

@johnpoz said in NTP Issue:

@ARAMP1 this seems a bit odd

Something with the DNS server? Here's my setup.

DNS server.jpg

johnpoz

@ARAMP1 no it wouldn't have anything to do with dns, because your pointing to an IP for the server.

I would think that ref ID would point to the IP your asking.. see in mine it shows my 192.168.3.32?

It might be like that because it has never gotten an answer? So it has no ref as of yet?

From your sniff you get an answer, so why would ntp think it can not reach that server?

johnpoz

@ARAMP1 can you turn off ntp and validate nothing is listening on 123..

example

ARAMP1

packetcapture-ix1-20240602204723.pcap

I've still pointed clients at 192.168.10.120 directly, so that would still show something listening on port 123, right?

johnpoz

@ARAMP1 not clicked to not enable it

As you see when I disable it nothing is listening on 123

Also can you one you enable it again, post up your ntpd.conf

[23.09.1-RELEASE][admin@sg4860.home.arpa]/: cat /var/etc/ntpd.conf 
# 
# pfSense ntp configuration file 
# 

tinker panic 0 

# Orphan mode stratum and Maximum candidate NTP peers
tos orphan 12 maxclock 5


# Upstream Servers
server -4 192.168.3.32 iburst minpoll 6 maxpoll 10 prefer


enable stats
statistics clockstats loopstats peerstats
statsdir /var/log/ntp
logconfig =syncall +clockall +peerall +sysall
driftfile /var/db/ntpd.drift
restrict default kod limited nomodify nopeer notrap
restrict -6 default kod limited nomodify nopeer notrap
interface ignore all
interface ignore wildcard
interface listen igb2.1011
interface listen igb3
interface listen igb0
interface listen igb4
interface listen igb2
interface listen igb2.110
interface listen igb2.6
interface listen igb2.4
interface listen igb5
interface listen lo0
[23.09.1-RELEASE][admin@sg4860.home.arpa]/:

ARAMP1

@johnpoz said in NTP Issue:

cat /var/etc/ntpd.conf

cmd prompt.jpg

johnpoz

@ARAMP1 ok the only thing that looks odd is your restrict 192.168.10.120 that is not really a network that is a host address. The network with /24 would be 192.168.10.0

After seeing yours noticed mine wasn't even listed... I removed mine completely because to be honest that is for clients wanting to talk to pfsense as their server. So you shouldn't even need that.

I would remove it, but that would be really crazy if that was the issue.

Nothing is there that makes any sense to why it wouldn't be working that I am seeing..

So you have no native network on the ix1 interface.. Only vlans.. I take it ix1.10 is your 192.168.10 interface..

ARAMP1

@johnpoz I'm not following when you say "I would remove it". What would/did you remove?

I have a native network on the ix1 interface but it's not enabled.

INterfaces 3.jpg

Gertjan

@ARAMP1 said in NTP Issue:

I'm not following when you say "I would remove it". What would/did you remove?

Here :

JonathanLee

One other small note:

Anyone remember that authentication ticket that has been open for years with NTP, someone named Mathew fixed it and has a pull in the system no one has reviewed it yet, it fixed the GUI issue and also some other items with the pool for NTP.

@MatthewA1 @LamaZ

https://github.com/pfsense/pfsense/pull/4658.diff

Did this github ever get merged?

847e417b5612f28bc1e84ca028a980df9c5c57a7

I can pull it in patches now

MatthewA1

@JonathanLee Officially been 6 months since the last feedback I've gotten... PR is still open with the "Changes Requested" label applied even though I made the requested changes

JonathanLee

@MatthewA1 push it to the new development version see what happens, I think that older thread is not being looked at any longer

stephenw10

The PR is against master so that would be 2.8-dev at this point.

MatthewA1

@stephenw10 Should I have opened the PR against a branch for 2.7 when I first opened it instead of master? As of now, it is in the correct place though right?

stephenw10

Nope master is almost always the correct place because that's where all the development happens. It's much easier to merge and test stuff there.

If it all works well, and there is cause to do so, it can be back ported to 2.7.X.

admacdo

I'm still running 2.7.2 as everything else seems to be just fine, but things have changed on my network a while ago with yet another stratum 1 NTP server.
I expect I won't be totally happy until I have four, but that will be risking death from my girlfriend, if she ever finds out.
The number of NTP based clocks has also increased from one to four.
I can recommend the "When" iottimer wifi clock from Aliexpress actually. Just follow the instructions about refreshing your browser window once you try changing it to English, or it won't appear to change.

Anyway, the second NTP server has two interfaces which can be independently configured, so today I decided to fire up another firewall interface and allocate it a class B address and directly connect it to the second interface on the new NTP server.

So now I have three local stratum 1 NTP sources configured. All NTP servers show the connections from the firewall on all three interfaces when it polls them every minute.

As far as the firewall is concerned, they're pending/unreachable.
For extra fun, the interface connected solely to the NTP second interface has an explicit permit any NTP rule.

I even tried setting the second NTP server interface to broadcast mode. Zilch.

It's disappointing as prior to 2.7.2, my firewall was sub millisecond synchronised.

stephenw10

Do you see replies back to the fire wall in the states? Or in a pcap?