Best practice: Receiving NTP from upstream NTS-enabled router?
-
Hi everyone,
I'm setting up a network where an upstream OpenWRT router handles NTS-authenticated time synchronization, and pfSense sits behind it:
Internet -> OpenWRT (NTS client) -> pfSense -> LAN
Since pfSense doesn't currently support NTS natively, I'd like pfSense to sync its time from the OpenWRT box via standard NTP instead of querying public servers directly.
Is this a common or supported configuration?
What's the best way to configure pfSense's NTP service to sync only from a specific internal IP (the OpenWRT router) and reject all other NTP sources?
Any known issues or caveats with this setup?And has anyone found a workaround to use NTS on Pfsense?
Looking for a simple, stable approach. Thanks!
-
@Feline said in Best practice: Receiving NTP from upstream NTS-enabled router?:
What's the best way to configure pfSense's NTP service to sync only from a specific internal IP
Remove pointing to pool and point it at your openwrt IP.
If your not running ntp service on pfsense - then just in the general tab. If you running ntp service, for say clients behind pfsense. Then in those settings.
If you are running ntp service - and set it there is will auto set the general settings to point to the same place
I point pfsense to my ntp server running on a pi, while the normal ntp client that pfsense runs does not support nts, you can use ntpv3 auth (RFC 1305). I recall seeing some talk of running chrony on pfsense. Might be some threads how around here - it supports nts.
edit: here you go - interesting read
I took a quick look through to refresh my memory, I guess chrony on pfsense has issues with licensing, and use of ntpsec some other issue that would make it problematic to switch pfsense over to it. You would have read the whole thread.
But if you have your openwrt doing your time via nts like you want, then yeah just point pfsense at its ip and you should be good to go.
btw - back when I switched over my pi to running chrony, I also took the time to setup ntpv3 auth - not that I think it makes any sense on my secure local network. There sure isn't anything or anyone on my local network that would be doing a mitm on my ntp.. But did it as a learning exercise - and it works and was pretty easy to setup.
-
@johnpoz said in Best practice: Receiving NTP from upstream NTS-enabled router?:
There sure isn't anything or anyone on my local network that would be doing a mitm on my ntp..
Well your threatmodel isn't my threat model and that's ok I guess. I suffer from a bad man; since he can't get into my panties anymore he tries to penetrate every nook and cranny in my network and devices. Nts does the job.
Thank you very much for all the information! Very kind of you.
I will try to read the whole very long post :) -
@Feline said in Best practice: Receiving NTP from upstream NTS-enabled router?:
penetrate every nook and cranny in my network and devices
How would this "bad actor" have any access between your internet connected device and some ntp server? Does he work for your isp?
In theory for a bad actor to trick your ntp service into setting the wrong time.. It would have to spoof the source IP you were set to talk to.. And it would have to be timed in such a manner that your client thought it was a response to its query.. And for it to accept this answer it would have to be somewhat close to the actual time your ntp server already thinks it is.
If your ntp server thinks its 11:42am - it doesn't just change the time to 12:22 am because some random ntp was sent to it on port 123.
Not saying mitm for ntp can not happen, I am not saying it does not have some use in conjunction with some other exploit, etc. But its not as simple as just sending some ntp traffic with wrong time info in it to some ntp server.
Nor am I saying you should not do you when it comes to security - if you want to use nts, go for it, if you want to use ntpv3 auth go for it. I am just saying the the risk level is pretty freaking low. But no currently the ntp client/server in pfsense does not support nts. And from that thread, I doubt it will become an option in native pfsense deployment any time soon. You can for sure run some other ntp instance on your network that supports the security features you want - like your doing with openwrt. You could then even use ntpv3 auth from pfsense to it if you wanted too. Or run ntp service internally and not even use an external ntp source. I use a pi with a gps hat, that and I use pps off that.
But to me - if I was looking at ways to harden my network security. Go for the low hanging fruit. To me nts would be at the top of the tree with the fruit padlocked to a harden steel pole ;)
-
I would love to explain it to you in detail in a private chat. But not on a public forum because that would be terrible operational security. Let's keep it at this; if someone is good enough and wants to get in bad enough - they will get in. And yes were talking about a chain of exploits
-
@Feline Like I said you do you.. Nothing wrong with it.. Sorry you are having issues that you believe such steps are warranted.
Privacy Policy · Cookie Policy