NTP Unavailable

[majorsl]

Is the Time Server in OPNSense supposed to be able to be used as a regular time server for clients or just DHCP's Option 42?

I tried to get to mine:

ntpdate -q 10.0.1.1
server 10.0.1.1, stratum 16, offset -0.224538, delay 0.02814
9 Dec 19:55:25 ntpdate[81504]: no server suitable for synchronization found

The service is running. I have LAN highlighted as the interface to listen on:

[fichtner]

ntpdate won't sync, because it does not consider your server to be reliable (stratum 16).

http://serverfault.com/questions/277375/ntpdate-d-server-dropped-strata-too-high

The topic suggest that "restrict default" in the ntpd.conf may be causing clients not to sync. On the road at the moment, can provide a patch later.

http://www.linuxquestions.org/questions/linux-server-73/ntpdate-no-server-suitable-for-synchronization-found-931430/

This topic suggest that ntpd does not have a valid (reachable) upstream server set.

Hope that helps,
Franco

[fichtner]

I can confirm your findings:

$ ntpdate -d 192.168.56.2
10 Dec 16:07:15 ntpdate[24019]: ntpdate 4.2.6@1.2089-o Fri May 28 01:20:57 UTC 2010 (1)
Looking for host 192.168.56.2 and service ntp
host found : 192.168.56.2
transmit(192.168.56.2)
receive(192.168.56.2)
transmit(192.168.56.2)
receive(192.168.56.2)
transmit(192.168.56.2)
transmit(192.168.56.2)
transmit(192.168.56.2)
192.168.56.2: Server dropped: strata too high
server 192.168.56.2, port 123
stratum 16, precision -6, leap 11, trust 000
refid [192.168.56.2], delay 0.02684, dispersion 24.05402
transmitted 4, in filter 4
reference time: 00000000.00000000 Mon, Jan 1 1900 1:00:00.000
originate timestamp: da1413a4.13e3c105 Thu, Dec 10 2015 16:07:16.077
transmit timestamp: da1413a5.12ccb3a2 Thu, Dec 10 2015 16:07:17.073
filter delay: 0.02684 0.04147 0.00000 0.00000
0.00000 0.00000 0.00000 0.00000
filter offset: 0.107932 -0.00011 0.000000 0.000000
0.000000 0.000000 0.000000 0.000000
delay 0.02684, dispersion 24.05402
offset 0.107932

10 Dec 16:07:18 ntpdate[24019]: no server suitable for synchronization found

[fichtner]

I think that disabling Access Restrictions setting "Deny mode 6 control message trap service (default: enabled)." fixes this (Network Time: Settings).

Can you confirm?

[majorsl]

Disbling is not making a difference for me, if I use the default ntp servers directly on my client, I get stratums of 2 or 3. But when used via OPNSense I'm up at 16.

ntpdate -q 0.nl.pool.ntp.org
server 178.21.23.127, stratum 3, offset -1.460397, delay 0.15919
server 87.195.109.106, stratum 2, offset -1.456223, delay 0.14459
server 141.138.142.81, stratum 2, offset -1.454538, delay 0.15300
server 213.154.236.182, stratum 2, offset -1.458007, delay 0.15610
10 Dec 17:41:56 ntpdate[77923]: step time server 87.195.109.106 offset -1.456223 sec

ntpdate -q 10.0.1.1
server 10.0.1.1, stratum 16, offset -1.453388, delay 0.02795
10 Dec 17:42:55 ntpdate[78135]: no server suitable for synchronization found

[majorsl]

It is working now, but for me it was turning off the "kiss-o-death" packets that did it. My "deny mode 6" is enabled and working. Maybe some of these should be disabled by default if only using on LAN?

Either way, I now know a lot more about NTP then I did yesterday, and that's good! Thank you!

[fichtner]

You and me both. :) It's a bit of black magic, better not touch these values. They might break other setups.