Best practice for NTP source?

[sjjh]

I'm setting up a small PVE cluster, which should also contain a VM with a OPNsense firewall. The OPNsense-VM will provide among e.g., DHCP, also NTP to the clients of the network. Now I'm wondering what is best practice to set-up NTP on the proxmox nodes: Should the NTP server be the OPNsense-VM, like (like for other devices on the network), or should I use a public NTP server (e.g. from the debian pool)?
The OPNsese-VM itself is fetching the NTP data from a public NTP server.

Welcoming any advice!
Simon

 

[bbgeek17]

Any cyclic dependency can lead to unpredictable issues down the road. OPsense depends on Proxmox to function, Proxmox depends on Opsense. Granted NTP may not be critical (except some cases).
If Proxmox can access outbound internet without relying on OPsense, then why not go directly to the source?

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox

 

[sjjh]

Thanks for thee fast reply.

Any cyclic dependency can lead to unpredictable issues down the road

I had the same thought. This is, why I e.g., used static IP addresses defined on the nodes and not fixed addresses provided via DHCP (running on the OPNsense).

If Proxmox can access outbound internet without relying on OPsense

Probably not. But still, functioning NTP on OPNsense is probably not needed for Proxmox to access the internet.

then why not go directly to the source?

To lower the load on the public available NTP servers by using OPNsense as proxy, was my thought.

 

[bbgeek17]

To lower the load on the public available NTP servers by using OPNsense as proxy, was my thought.

The massive farms run by governments, universities, public and private corporations wont notice your absence. Its up to you!

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox

 

[Astraea]

I use pfSense but same difference and have all of my Proxmox hosts and VMs using pfSense for the NTP source of truth. I have pfSense going out to the internet to the an NTP time and while my pfSense is a VM within my cluster having 7 nodes running in a HCI setup I haven't had any issues other than some complaints of time being out of sync for Ceph when it's a cold start of the cluster.

 

[sjjh]

I use pfSense but same difference and have all of my Proxmox hosts and VMs using pfSense for the NTP source of truth.

If I may ask, what was the reason for this setup, why didn't you use a source directly from the internet?

 

[Astraea]

I wanted all devices on my network to use the same time, this way only 1 device is going to the internet to get the time and the rest are getting it from that device. Eventually I would like to move to a raspberry pi or simular device thar can provide time through GPS but it will still probably provide it to pfSense for ever other device to get the time from pfsense still.

Because my firewall is virtual and on a HA setup the only single point of failure atm is my main switch but I will moving to a dual main switch at some point I already have redundancy in my internet connection.