How can i create route to access NTP server located in another subnet?
-
Hello !
I would use some advice on how can i properly set some routes in my network. I am building small test network where i have a few devices:
- FTP server (172.16.1.10)
- NTP server (172.16.100.200)
- Web server (192.168.2.10)
- My testing device (192.168.1.50)
I am using pfSense as my firewall and i managed to use a single IP (192.168.1.x) and get access to all servers by defining virtual IPs. Now, i came across a challenging situation:
My testing device (192.168.1.50) needs to sync the time with NTP server (172.16.100.200). This is something that i do not know how to address. My device is running embedded linux with some ntp client software. So they are capable of syncing with the NTP server. But the issue is that the device won't sync if i am in 192.168.1.x segment and the server is in 172.16.100.x.
What have a done so far, is that i changed the IP address of the testing device to the same class as NTP server (172.16.100.90, for example). If the settings are like this, the device syncs with the NTP and all is working fine.
Now i need to figure out how to make the device sync when the NTP is not in the same network segment. For this i have created the following test scenario: i defined virtual IPs: 172.20.1.1 /29 for devices under test and 172.16.100.1 /24 (this is NTP lan segment).
So the test LAN has 8 hosts, with 6 actual usable hosts. The GW should be 172.16.100.2 and my device has 172.16.100.3. The NTP server address is 172.16.100.200 and it is not reachable. I tried to ping it but it fails.My assumption is that without adding (by hand) proper routes the test device will not find that NTP server.
Knowing my test device network segment and NTP network segment, can i add routes inside pfSense ?
Can you help me with some explicit configuration for this particular case?
So far, i worked with static routes in Windows and Linux but only at the client side. I never did configs on the network devices (such as gateways or routers) so this is something that i am trying to learn. My goal is to replicate this test device -> ntp server to the other servers as well (ftp and web). I assume that if i manage to make the routes for NTP, it would be the same for the others.Any information or link to online resources is greatly appreciated.
Thank you!
Best regards,
J. -
@jay209
Just add a NAT port forwarding rule to the interface, where the client is connected to for TCP/UDP, any destination IP, port 123 and forward it to your NTP server port 123. -
@viragomann Wow! That was simple solution. I did put a rule allowing all requests for NTP and works !
Thank you!
-
@jay209 said in How can i create route to access NTP server located in another subnet?:
Knowing my test device network segment and NTP network segment, can i add routes inside pfSense ?
Huh? Any network connected to pfsense, pfsense already knows the "routes" to these networks its attached too. The only time you would have to route to a network is if this network is not directly attached to pfsense, and you need to send the traffic to some other gateway to get to that network.
Seems like you got it working, you didn't go the port forward method did you? All that is need is a firewall rule on your ntp clients side interface too allow UDP 123 to ntp servers IP on some other pfsense segment. If your ntp server is also using pfsense as its gateway your all set.
Other than maybe the ACLs you might have set on your ntp server, it would need to allow for this other network to ask it for time..
-
@johnpoz I did go thorough port forward method. Initially i believed that setting the specific networks (172.x.x.x, 192.x.x.x, etc), in Virtual IPs, would be the only thing i need to do.
My first NTP server ran CHRONY but for some reason it was not able to provide time to the embedded linux devices. My Windows computer synced pretty fast.
Now, I switched to NTP daemon under Ubuntu. All embeded linux devices are syncing.
I also disabled the port forward and... the devices sync. Maybe it was because of the Ubuntu minimal server that i use.
The test device is not running firewall so i would pin point to the NTP server.Guys, sorry for this but i am new in this area... Thank you for guiding and having patience with me. I'll test more tomorrow and if i can get away with networks defined in Virtual IPs, this is the best solution that i need.
Thank you, once again !
Best regards,
J.
