Force all devices to use the ntpd server

[coalbl4ck]

I am new to OPNsense and was reading through my blocked traffic to see that my rules apply correctly when i noticed the block of NTP requests since i do have that port blocked for requests to WAN.

Now i read up and figured that you can reroute all NTP traffic to the inbuilt ntpd-server.
Now i want essentially the same as here in this thread https://forum.opnsense.org/index.php?topic=6492.0.
Unfortunately the linked image got lost, however i am still confident that my configuration is mostly correct.
.. yet it doesn't work.

I have a NAT:Port Forwarding rule configured:
     

Code Select Expand

Interface:        LAN
TCP/IP:           v4
Protocol:         UDP
Source:           LAN net
Destination
Invert:           check
Destination:      LAN net
Destination
port range:       NTP-NTP
Redirect
target IP:        127.0.0.1
Redirect
target port:       NTP
Pool options:     default
NAT reflection:   Disable

Also i checked whether the ntpd-server is actually running which looks pretty good:

Code Select Expand


sockstat -l | grep :123
root     ntpd       83772 20 udp6   *:123                 *:*
root     ntpd       83772 21 udp4   *:123                 *:*
root     ntpd       83772 22 udp4   192.168.1.1:123       *:*
root     ntpd       83772 23 udp6   ::1:123               *:*
root     ntpd       83772 24 udp4   127.0.0.1:123         *:*


When i activate logging i can see that the NAT is matched for all WAN requests to port 123.
Tested with:

Code Select Expand

sntp -t 15 0.arch.pool.ntp.org

I am pretty sure there must be a simple explanation/ solution. However currently i am just stuck.
Help is much appreciated! :)

[Mks]

Hi,

Target IP: LAN address

should do it as long as the NTP is listening on that Interface.

br

[coalbl4ck]

Thanks for that answer.

However, i am not sure i understand it correctly.

Selecting from 'Redirect Target IP' does not give me the option to select 'LAN address'.

The interface of the NTP server is on the localhost of the OPNsense server, so isn't 127.0.0.1 correct for 'Redirect Target IP'?

br

[Patrick M. Hausen]

127.0.0.1 should work. I have been using a similar setup. There is one minor "trick" in the port forwarding configuration: look way down at the "Filter rule association" field and set that to "Pass".

[coalbl4ck]

Yess that's it! Thank you!

I had set it to local redirect or something.. never thought that would be the problem.