Proxmox Cluster time sync problem

[rdfamily]

I have a 3 node cluster but one of the nodes is slowing losing time. it can lose 5min in just an hour. I setup chrony to point to a Windows AD thats providing NTP connected to internet using 0.us.pool.ntp.org servers. while it show that chrony is active it's still losing time and not syncing to the Windows server.
root@perko1:~# chronyc sources
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^? 192.168.1.31 3 6 377 50 -1013s[ -1013s] +/- 7847ms
root@perko1:~#
root@perko1:~# chronyc tracking
Reference ID : C0A8011F (192.168.1.31)
Stratum : 4
Ref time (UTC) : Thu Jan 15 16:50:16 2026
System time : 0.000000008 seconds slow of NTP time
Last offset : -878.165527344 seconds
RMS offset : 878.165527344 seconds
Frequency : 83267.336 ppm fast
Residual freq : -2580.981 ppm
Skew : 47.938 ppm
Root delay : 0.079696670 seconds
Root dispersion : 30.896707535 seconds
Update interval : 0.0 seconds
Leap status : Normal
root@perko1:~#
root@perko1:~# timedatectl
Local time: Thu 2026-01-15 14:55:52 EST
Universal time: Thu 2026-01-15 19:55:52 UTC
RTC time: Thu 2026-01-15 19:56:45
Time zone: America/New_York (EST, -0500)
System clock synchronized: yes
NTP service: active
RTC in local TZ: no

chrony.conf file attached

 

[Onslow]

Hi. Any clue in systemctl status chrony and in journalctl -u chrony ?

 

[BobhWasatch]

The chronyc sources output says it isn't synced (left-most column).

 

[leesteken]

Maybe the host time is so very much different (16:50 UTC versus 19:55 UTC) that you should set it manually first? Maybe there still is a problem connecting to the time server? Did you fix the firewall/different-subset issue: https://forum.proxmox.com/threads/pve-cluster-time-sync-questions.179141/#post-831444 ?

PS: Please use Code-tags or Inline-code to format tables to make them readable.

 

[BobhWasatch]

It is because he's trying to sync to a Windows DC and per usual Windows does things different. See for example:
https://support.scc.suse.com/s/kb/Synchronize-chrony-with-a-Windows-NTP-Server?language=en_US

 

[rdfamily]

ok, base on this I would then want to get to the point where I can do NTP from my Firewall. I added and third bridge with a port connected to the 10.0.x.x network but I can't add a gateway IP to it so what changes do I need to make to be able to the the firewall device (10.0.0.1)

 

[cwt]

Is your gateway on 192.168.1.X your firewall or another router? Usually your vmbr2 should reach your 10.0.0.x net via the default gateway, except if your firewall is not in the same layer2 network.

ip route should give you this (for example):

default via 192.168.1.1 dev vmbr0
10.0.0.0/24 dev vmbr2 proto kernel scope link src 10.0.0.10