[SOLVED] NTP not answering on 2-nd uplink WAN
-
@stephenw10 said in NTP not answering on 2-nd uplink WAN:
@Sergei_Shablovsky said in NTP not answering on 2-nd uplink WAN:
I have the same decision. But the gateway are directly set in “Advanced Option / Gateway” in pf rule.
Ah wait you set the gateway on the inbound WAN pass rules for NTP queries?
Exactly.
You should not set a gateway there.
At the start of topic I have a “Default” as Gateway in “Advanced Options”.
But issue still exist, so I decide to set directly.The fact traffic is passed on an interface with a gateway is sufficient to tag it reply-to for that gateway. Setting a gateway on an inbound rule is incorrect as it will try to force traffic that way.
Ok, set “Default” in “Advanced Options” back. ;)
And reboot.But issue still exist.
-
Ok make sure the states still appear the same for connections on both WANs without the gateway set on the rules.
Make sure the working WAN still follows the system default gateway. -
@stephenw10 said in [SOLVED] NTP not answering on 2-nd uplink WAN:
Ok make sure the states still appear the same for connections on both WANs without the gateway set on the rules.
Still appear.
Make sure the working WAN still follows the system default gateway.
Still follows.
But issue exist. ;)
-
@stephenw10 Thank You SO MUCH for patience and help!
After rewriting a lot of rules, and manually saving some scripts (f..k previous admin!), double checks all physical connections and all in System / Advanced: I just reinstall pfSense CE 2.7.2-RELEASE on this server with “Use previous config” option and the issue gone away
P.S.
Of course, I would be happy to help John to finding this bug, but due complexity of settings not possible to reproduce it… Sad. -
Hmm, weird. Hard to see why it wouldn't have been applying reply-to tags.
I guess good result in the end!
-
@stephenw10 said in [SOLVED] NTP not answering on 2-nd uplink WAN:
Hmm, weird. Hard to see why it wouldn't have been applying reply-to tags.
Yeah! I find how to reproduce the issue, that’s the scheme:
(there are 2 uplink ISP, the 2 connections from each)
WAN-ALL group
— WAN-ISP-A group
—— WAN-ISP-A-1 DHCP interface
—— WAN-ISP-A-2 DHCP interface
— WAN-ISP-B group
—— WAN-ISP-B-1 DHCP interface
—— WAN-ISP-B-2 DHCP interfaceExist 1 main WAN interface group, that consist of 2 groups, one for each ISP. The each ISP group consist of 2 uplinks/interfaces.
So, totally 4 uplinks (with 2 of them temporarily not activated, mean 100% packet loss, but 1Gb link established).
There are BALANCED interface group created (with Tear 1 for each, and “Packet loss or Hight Latency” as Trigger Level.
And in System / Routing / Gateways this BALANCED group set as “Default Gateway IPv4”
So, ordinary multi-WAN setup for IPv4.
(I know that some settings in System / Advanced may impact on a result, so if You ask, I send screenshots to You by PM)In Firewall aliases exist NTP_PORT alias with 123 and 1023 ports.
THE ISSUE!!!:
If “pass from all incoming UDP on This Firewall (self) on NTP_PORT” pf rule exist on WAN-ISP-B or WAN-ALL level ~> NTPD ANSWERS OUT ONLY FROM (default) INTERFACE !If the SAME rule moving to INTERFACE level (both WAN-ISP-B-1 DHCP interface & WAN-ISP-B-2 DHCP interface) ~> NTPD ANSWERS OUT FROM BOTH INTERFACES on which NTP requests come in.
I reinstall pfSense from scratch several times (with “using previous config” option) and triple confirm the issue!
I guess good result in the end!
With a lot of spending hours also… ;)
-
Ah you actually have an interface group for the WANs with the rule on it?
Yes, if you do that reply-to tags cannot works because the rule applies to multiple interfaces. It cannot know which interface (gateway) to reply to.
For reply-to tagging to work incoming traffic must be passed on the interface itself. It's the same reason that OpenVPN traffic must be passed on an assigned interface for repy-to to work. The group openvpn interface will not tags it.@Sergei_Shablovsky said in [SOLVED] NTP not answering on 2-nd uplink WAN:
And in System / Routing / Gateways this BALANCED group set as “Default Gateway IPv4”
That's still invalid. The system default gateway should only be a specific gateway or a failover group. You cannot load-balance traffic like that.
Steve
