Review pfSense boot-time clock bootstrap separately from its running NTP service

A firewall can contact bootstrap time servers before the persistent daemon starts.

Source facts

Netgate documents two once-per-boot clock actions: using recent filesystem timestamps and making a one-time sync to static-IP NTP servers. The latter avoids a DNSSEC dependency when an inaccurate clock prevents resolving time-server names. A dedicated ntp-boot-time-servers file can supply alternate IPs; an existing empty file disables that initial network sync.

Source: Netgate — Clock Bootstrap Behavior.

Applicability

This concerns pfSense clock bootstrap behavior before the NTP daemon.

DSE recommendation

DSE recommends including boot-time dependencies in restricted-egress and time-service designs. If policy requires approved time sources, configure a reachable bootstrap path instead of assuming the ordinary NTP server list covers startup. Preserve the custom file through the documented recovery process and record why it exists. Consider how a long shutdown affects timestamp-based approximation before disabling network bootstrap entirely. Ask the time-service owner to review boot-time and steady-state destinations on separate lines. If bootstrap is deliberately disabled or redirected, preserve the reason and an approved recovery test. Keep the bootstrap file choice in the rebuild inventory so replacement hardware follows the same clock-startup decision.

Verification

In an isolated reboot rehearsal, observe the early clock, bootstrap traffic, DNSSEC resolution, and subsequent daemon synchronization as separate events. Confirm the configured alternate IPs are reachable at that stage. Record the resulting startup sequence without claiming that a healthy steady-state NTP peer proves every boot-time dependency is satisfied.

Official reference

Netgate — Clock Bootstrap Behavior. Reviewed October 20, 2026.