0

So, we have an ntp server (ntp-4.2.8-r1) which uses this list of time servers:

server pool.ntp.org
server 24.56.178.140 
server 2001:470:0:2c8::2
server ntp.markyate.net
server ntpv6.dianacht.de
server 127.127.1.0

However, when I use ntpq to list peers:

mns0c log # ntpq -pn 127.0.0.1
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 24.56.178.140   .INIT.          16 u    -  512    0    0.000    0.000   0.000
*2001:470:0:2c8: .CDMA.           1 u   44   64  377   80.066    6.970   0.534
 127.127.1.0     .LOCL.          10 l    -   64    0    0.000    0.000   0.000
 129.250.35.250  .INIT.          16 u    -  512    0    0.000    0.000   0.000
+2001:4d48:ad51: 193.190.230.65   2 u   48   64  377   34.838    7.614   0.850
+2001:4d88:1ffa: 193.190.230.65   2 u   47   64  377   96.723  -27.702   0.812
mns0c log #

You can see that non of the ipv4 addresses are contactable.

This is further confirmed by a tcpdump. (I see two UDP packets leaving, but non coming back)

However, If I try using ntpdate -q <peer> I get a response! ( I know it won't actually affect my clock)

However, if I try ntpq -pn <peer> I do not get a response:

24.56.178.140: timed out, nothing received
***Request timed out

Any help greatly appreciated

GeoSword
  • 1,657
  • 12
  • 16

1 Answers1

1

I have the same issue. It appears some ISPs are blocking NTP traffic on IPv4 to prevent amplification attacks. I am using a tunnel broker for IPv6 as my ISP does not support IPv6. My tunnel broker is not blocking NTP.

BillThor
  • 27,737
  • 3
  • 37
  • 69
  • Thanks for the response Bill. It does make some sense, I noticed that ntpd traffic is sourced from port 123, where as traffic from ntpq/ntpdate is from a non privileged port. I guess they must be blocking only traffic sourced from 123 and destined for 123. Im going to see if I can do some port translation with iptables and see if that gets us around the problem. Its been like this for a week. – GeoSword Jun 22 '16 at 13:53
  • @GeoSword Please review the security notifications for NTP and ensure your server can't be used in amplification attacks. See https://www.us-cert.gov/ncas/alerts/TA14-013A for some info. – BillThor Jun 22 '16 at 23:30