setup server ntp problems

pigreco · Apprentice Joined: 16 Nov 2005 Posts: 223 Location: Italia

Hello,
I'm trying without success to setup a NTP server for synchronize multiple servers in my private lan.
I always get one stratum = 16 for the server that I made and I can not understand what the problem is, the firewall should be ok and I have no error in the logs.

some info:
ntpd.conf:

666threesixes666 · Posted: Mon Sep 16, 2013 10:07 pm Post subject:

su -c '/etc/init.d/ntpd status'

reports?

if stopped try

su -c '/etc/init.d/ntpd start'

see https://wiki.gentoo.org/wiki/NTP

pigreco · Apprentice Joined: 16 Nov 2005 Posts: 223 Location: Italia

hi,
thanks for reply

666threesixes666 · Posted: Tue Sep 17, 2013 3:10 pm Post subject:

"# Allow local lans to sync
restrict 192.168.1.0 mask 255.0.0.0 nomodify notrap "

what ip addresses do the clients have? if they are 192.168.1.X they should be able to sync. id change that line around to 0.0.0.0 so everyone can sync, but not modify.

pigreco · Apprentice Joined: 16 Nov 2005 Posts: 223 Location: Italia

hi, 666threesixes666,
yes the clients ip address are 192.168.1.X

but my problem is that my LAN ntp master not syncronize itself with network ntp servers, it's stratum is always too hight

Aiken · Posted: Wed Sep 18, 2013 10:06 pm Post subject:

When ntp queries remote servers it uses a source port of 123, ie local_machine:123 to remote_machine:123. The ntpq -crv will use an unprivileged port as the source port, mine just did local_machine:37670 to remote_machine:123.

If incoming packets to port 123 are blocked then the ntpq -crv you did will work fine but ntp itself won't receive any replies to time requests it sends. Try finding out if and where incoming packets to port 123 are being blocked. The ntpq -crv working shows out going packets to port 123 work. The stratum of 16 and reach of 0 that ntp is showing indicate it is not receiving any replies leaving me wondering if incoming packets to port 123 are blocked.

Easy enough to watch the traffic with tcpdump. Assuming eth0 then -> tcpdump -i eth0 port 123

When ntp is receiving packets you should start seeing the stratum of the remote servers and reach of 1 with in seconds after ntpd is started. Once you have that sorted I suggest you add at least 1 more server. 2 servers can work but it won't be reliable. While the 2 servers are close enough ntp will select one of them but too much of a difference then ntp won't chose either. This is fixed by having at least 3 servers.

The 2 servers you are using look to be from pool.ntp.org project and in europe so if you are going to use the pool you could remove the 2 server lines and just use

pool europe.pool.ntp.org

That gives me 4 servers. Hard coding the ip in ntp.conf can mean you send up trying to use non existent ntp servers if they are closed down.
_________________
Beware the grue.

pigreco · Apprentice Joined: 16 Nov 2005 Posts: 223 Location: Italia

hi, thanks for help
now after days of attempts I'm confusing...
I ave check again the firewall configuration and it seems to be correct but I can't see incoming comunications from time servers over internet

Aiken · Posted: Thu Sep 19, 2013 9:36 am Post subject:

To help confuse it a bit more I just used ntpdate -q <your ip> to query it from Australia. It showed as stratum 11 and approx 2.7 seconds from correct time.
_________________
Beware the grue.