NTP Service Fails to Start When Using WireGuard on the Same Interface

[mxc]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• [ x] I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• [ x] I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Describe the bug
After upgrading to OPNsense 25.1-amd64, the NTP service fails to start when a WireGuard instance is configured on the same physical interface that NTP is set to listen on.

Unfortunately, I am unsure of the exact previous version, but it was from the 24.x branch. I attempted to use opnsense-revert to determine the last known working version but was unable to retrieve this information.

To Reproduce

Steps to reproduce the behaviour:

1. Create a wireguard instance on an interface (re0_vlan225 - Lab)
2. In the NTP Service setting assign the interface (Lab)
3. Click apply
4. Start the service
5. The service does not start. The log contains:
   2025-02-18T10:00:00 Error ntpd unable to create socket on wg0 (15) for 172.29.0.1:123
   2025-02-18T10:00:00 Error ntpd bind(35) AF_INET 172.29.0.1:123 flags 0x11 failed: Address already in use
   2025-02-18T10:00:00 Error ntpd daemon child died with signal 11

Expected behavior

The NTP server should start

Describe alternatives you considered

I tried unassigning the wg0 interface to see if that would work but get the same error.

Screenshots

NA

Relevant log files

NA

Additional context

Add any other context about the problem here.

NA

Software version used and hardware type if relevant, e.g.:

OPNsense 25.1 (amd64).

[mxc]

If I stop the Wireguard instance and then start the Time Service and then restart the Wireguard instance it works

[Monviech]

https://docs.opnsense.org/manual/settingsmenu.html#listen-interfaces

This applies to any kind of service that you try to bind to specific interfaces, especially vpn ones. Use any interface instead and control access via firewall rules.

[fichtner]

If I stop the Wireguard instance and then start the Time Service and then restart the Wireguard instance it works

Because it ends up not binding to WireGuard? You can easily check the diff of the config file...

[mxc]

Thinking about it I got my logic wrong because I don't think wireguard binds to any physical interface it's purely virtual. I am not sure why the Time Services want to open a port on it since it is not available as an interface to bind to in the config ui.

@Monviech I don't select the wireguard interface to have NTP services bound to in the config UI. The configuration attempts to start an NTP server on it by itself for some reason.

@fichtner It works for a while before the NTP server fails again. Still investigating it. Will check the config file.