Pfsense Date & Time

Gertjan

Noop.
A (the pfSense) NTP client syncs with an NTP server, typically an IP (and in that case : no DNS needed ;) ), a host name or even a pool.
It tells you it wasn't able to do so.

Example :
I'm in France, so I used a local NTP server pool :

Because you should never 'type in stuff without checking, I've checked this "2.fr.pool.ntp.org" :

[24.03-RELEASE][root@pfSense.bhf.tld]/root: dig @127.0.0.1 2.fr.pool.ntp.org +short
195.154.226.102
149.91.80.92
91.224.149.41
82.64.81.218

This tells me 3 things :
The pool is a pool, there are several IPs.
The 'host name' resolves to IPs.
And, bonus : my DNS works.

My 'NTP' is happy of course :

Hummm : the status told me my check was wrong ....
Ok, again :

[24.03-RELEASE][root@pfSense.bhf.tld]/root: dig @127.0.0.1 2.fr.pool.ntp.org AAAA +short
2001:41d0:801:2000::acb
2001:41d0:304:200::6803
2603:1020:802:3::a8
2001:861:4080:81b1::3

Also fine.

Cleetus Antony

@Gertjan said in Pfsense Date & Time:

dig @127.0.0.1 2.fr.pool.ntp.org +short

Thank u for the info.
My NTP is sad.

johnpoz

@Cleetus-Antony well your never going to sync if you can not resolve anything in the pool name your using.

If you try and resolve that fqdn, what do you get back?

23.09.1-RELEASE][admin@sg4860.home.arpa]/root: dig 0.in.pool.ntp.org

; <<>> DiG 9.18.16 <<>> 0.in.pool.ntp.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21553
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;0.in.pool.ntp.org.             IN      A

;; ANSWER SECTION:
0.in.pool.ntp.org.      3600    IN      A       157.245.102.2
0.in.pool.ntp.org.      3600    IN      A       162.159.200.123
0.in.pool.ntp.org.      3600    IN      A       162.159.200.1
0.in.pool.ntp.org.      3600    IN      A       95.216.192.15

;; Query time: 326 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Fri Jun 14 07:54:50 CDT 2024
;; MSG SIZE  rcvd: 110

Also you have 2 notifications I see up there the red bell with 2 next too it - those are normally things you should pay attention too, and quite often point out stuff that had an error, etc..

Cleetus Antony

@johnpoz

johnpoz

@Cleetus-Antony ok well its resolving... So that is good.. Odd that ntp doesn't show that, I would think it would show the IPs it resolved and then if couldn't talk to them the reach would just be at zero, etc..

But yours is showing nothing, like it couldn't resolve what IPs are in the pool? Is that maybe a O vs a 0 (zero)?

You could try putting in say one of those IPs directly vs as a pool and see if it shows that IP.. And can it talk to it.. I would then sniff on your wan to validate its sending ntp, and maybe you just don't get an answer?

Gertjan

@Cleetus-Antony

Do you have a PC with a windows OS ? or any OS actually, as every device has a ntp client these days.
Get any of the IP's, and give it to your ntp windows client :

and test it.

Still doesn't work ?
Start checking your upstream 'WAN' (ISP ?) connection. Some one might be filtering upstream.
You don't have any pfSense floating firewall rules, right ?

Cleetus Antony

@Gertjan

I have no additional rules set. All default ones.
Before this ntp, I used pfsense default ntp settings. Stil the issue was same.

Cleetus Antony

@Gertjan

I put one of the ip into ntp. its not reaching.

But from pfsense, its pinging.

Uglybrian

The firewall can notify administrators of important events and errors by displaying an alert in the menu bar, indicated by the bell icon. Out of cuirosity what are your notifications?

johnpoz

@Cleetus-Antony pinging is different than ntp.. While ping is good that you can actually get there.. Doesn't mean its answering ntp, or that it even sees your ntp query..

First thing is to actually validate your ntp query is leaving your wan, and has been natted to your IP.. If you see the query go out - and get no answer.. Not something pfsense can have any control over.. You would then need to look up stream if something is blocking, etc...

Cleetus Antony

@Uglybrian

Notifications was not related NTP.
It was abt some user settings.

Cleetus Antony

@johnpoz
I checked with a windows client pc connected after the pfsense and configured the ntp 1.in.pool.ntp.org and synced the time. it does well. but the same ntp server is not reaching in pfsense... strange huh ?

My pfsense is behind the FTTH modem/router in which 1.in.pool.ntp.org is configured and it does the job. So we can conclude that this ntp is not being blocked in upstream right ???

johnpoz

@Cleetus-Antony said in Pfsense Date & Time:

So we can conclude that this ntp is not being blocked in upstream right ???

if your client can talk to it, yeah - but still doesn't validate pfsense is actually sending or natting the traffic.. Or that it likes the answer? A simple sniff would allow you to validate that it talks and gets an answer and what that answer actually was, etc.

It takes all of a few seconds to do a sniff.. Longest part would be waiting for the timer of when ntp would resend, which is like 64 seconds.

Also ntp 1.in.pool.ntp.org is not what you were showing you were using in pfsense.. You were using 0. Or the 1 specific IP, etc.

Cleetus Antony

@johnpoz sniff14.6.24.pcapng

Done the sniffing in the client pc and attached the file.
If u cud find anything ...!

johnpoz

@Cleetus-Antony dude limit your sniff to port 123.. On pfsense WAN... Your wanting to see what is happening when pfsense ntp is asking..

Make sure none of your clients are asking outside ntp during your testing.

If you don't see anything - and the counter has cycled through a couple of times on pfsense - then that would explain why its not working - for whatever reason pfsense is not sending ntp out your wan..

Are you routing traffic through a vpn or something?

Cleetus Antony

@johnpoz

I set the filter tcp.port ==123 and saw nothing matching traffic in wireshark. As u said pfsense is not sending any ntp request out I guess.
I set an outbout WAN rule also to NAT anything out from the firewall itself... still no effect.
I did even reset the state of firewall also.
As u asked, I am not routing traffic through a vpn.
I am using version 2.7.2 the latest one. Is there any bug ?

johnpoz

@Cleetus-Antony its not tcp its UDP.. just set the port number, you don't have to set protocol. Did you make sure you selected your wan?

I set an outbout WAN rule also to NAT anything out from the firewall itself... still no effect.

You understand that is not required - and loopback is natted already in the automatic outbound nats - are you not using automatic outbound nat?

No there no bug for ntp on 2.7.2 that aware of.. I just setup my 2.7.2 to use your pool and its working fine.

192.168.3.109 is my 2.7.2 wan because its behind a nat..

Cleetus Antony

Look at the packet capture and see the time... huh... time is taking correctly as per my timezone. That time I need. But in the attached home screen the time is wrong... strange....!!!!

Something small I am missing to do in the box ?

As u asked me, Automatic loopback NAT rule is working in my WAN.

johnpoz

@Cleetus-Antony oh we got 2 different threads going with different things... In one the pool is not working, and your the guy with timezone issue??

Packet capture should be in utc.. IST is what 5.5 hours ahead of UTC?

I am behind UTC by 5 hours in CDT.. So yeah a packet capture timestamps will be off by what timezone your in - packetcaptures are always in zulu or utc..

You sure seem to be working?? I asked you to sniff on your wan.. your wan is 192.168.10.32? Your behind a nat?

I see sending in that sniff - but I don't see any reply.. Not sure what you expect to happen if you don't get an answer - no ntp is not going to work if there is no answer..

Cleetus Antony

@johnpoz

pfsense WAN is 192.168.10.32. I am behind a NAT of FTTH modem.

In my capture attached the time is correct. So the pfsense is taking correct time.
But why this correct time is not reflecting in my home screen.. also not working my rules as per the configured schedule... thats my worry.

CDT time I mentioned earlier was just a test. Now I set with IST which is correct as per my country.