NTP not visible from internet

[NIIcK]

Hello,

I have a OPNSense installation on a machine with a single NIC, set up with PPPoE (no LAN, only public IP).

All allowed ports are visible from the internet except 123 even though the NTP service is shown as started and the server is reporting syncing the time.

I can't use the server at all at this time. If you have any ideas please help.

Thank you,

Nick

[meyergru]

1. Some ISPs block certain ports per default, so maybe the problem is not OpnSense.
2. Maybe a dumb question to ask, but you are aware that NTP runs on UDP? To find if UDP ports are actually "visible" is more difficult than with TCP.

Interesting setup for an OpnSense. Only WAN, no LAN and exposing NTP to the internet?

[NIIcK]

Thank you for taking the time to respond to my question. There are no ports blocked by the ISP as I live in Romania and all of the contractual ports and protocols are available to me (bragging a bit but not really).

Of course I know NTP runs on UDP. If I change the OS and set it up everything is fine. On OPNSense things stop working after the initial system update (update prompt for the available download image).

Actually everything works till you get the overall system upgrade, after which static v6 is not working anymore neither NTP.
Will follow up with more info after the last statement.

[NIIcK]

I have monitored the status of the NTP traffic.

Having the UDP port 123 set to allowed on both IN and OUT rules, enabling the firewall keeps allowing these rules for several minutes then it blocks ALL NTP traffic, including the local NTP server communicating with its NTP servers for time syncing -> reporting these time servers as unreachable on the NTP log.

The only way I can actually keep NTP synchronizing and reachable to machines needing time sync is to keep the firewall turned off.

Ran out of ideas.