Documentation
VyOS Documentation
VyOS Services
NTP Service

NTP Service

NTP (Network Time Protocol) is a protocol for synchronizing the clocks of computer systems over a network.

Overview

VyOS uses chrony (starting from version 1.4) to implement the NTP client and server.

NTP provides:

  • System time synchronization with millisecond accuracy
  • Automatic time correction
  • Leap second handling
  • A hierarchical system of time servers (stratum)
  • Simultaneous operation as both a client and a server

Protocol: UDP port 123

Current version: NTPv4 (RFC 5905)

Basic configuration

NTP client

Synchronization with public NTP servers:

set service ntp server 0.pool.ntp.org
set service ntp server 1.pool.ntp.org
set service ntp server 2.pool.ntp.org
commit

By default, VyOS uses:

  • time1.vyos.net
  • time2.vyos.net
  • time3.vyos.net

NTP server

Allowing clients to synchronize with VyOS:

set service ntp listen-address '192.168.1.1'
set service ntp allow-client address '192.168.1.0/24'
commit

NTP server configuration

Adding a server

set service ntp server <hostname|IP>

Examples:

set service ntp server pool.ntp.org
set service ntp server time.google.com
set service ntp server 216.239.35.0

Server options

prefer - Preferred server

Server priority when selecting a time source:

set service ntp server 0.pool.ntp.org prefer

noselect - Do not use for synchronization

The server is monitored but not used:

set service ntp server backup.ntp.org noselect

pool - Pool mode

Automatic name resolution and addition of multiple servers:

set service ntp server pool.ntp.org pool

A single DNS query can return multiple IP addresses, and all of them will be used.

nts - Network Time Security

Encrypted NTP connection:

set service ntp server time.cloudflare.com nts

NTS provides authentication and confidentiality for NTP traffic.

ptp - PTP Transport

Using the Precision Time Protocol transport:

set service ntp server ntp.example.com ptp

interleave - Interleaved Mode

Improved synchronization accuracy:

set service ntp server ntp.example.com interleave

NTP Pool

Public NTP Pools

NTP Pool Project (pool.ntp.org):

set service ntp server 0.pool.ntp.org
set service ntp server 1.pool.ntp.org
set service ntp server 2.pool.ntp.org
set service ntp server 3.pool.ntp.org

Regional pools:

# Russia
set service ntp server 0.ru.pool.ntp.org
set service ntp server 1.ru.pool.ntp.org

# Europe
set service ntp server 0.europe.pool.ntp.org
set service ntp server 1.europe.pool.ntp.org

# North America
set service ntp server 0.north-america.pool.ntp.org

Vendor-specific:

# Debian
set service ntp server 0.debian.pool.ntp.org

# Ubuntu
set service ntp server ntp.ubuntu.com

Major providers

Google Public NTP:

set service ntp server time.google.com
set service ntp server time1.google.com
set service ntp server time2.google.com
set service ntp server time3.google.com
set service ntp server time4.google.com

Cloudflare NTP (with NTS):

set service ntp server time.cloudflare.com nts

Facebook NTP:

set service ntp server time.facebook.com

NTP Server Configuration

Listen Address

Addresses to listen for NTP requests on:

set service ntp listen-address '192.168.1.1'
set service ntp listen-address '10.0.0.1'
set service ntp listen-address '2001:db8::1'

By default, it listens on all interfaces.

Allow Client

Allowing clients to synchronize:

set service ntp allow-client address '192.168.1.0/24'
set service ntp allow-client address '10.0.0.0/8'
set service ntp allow-client address '2001:db8::/32'

Without allow-client, the server will only synchronize itself but will not serve clients.

Leap Second

Handling leap seconds:

set service ntp leap-second <mode>

Modes:

  • ignore - ignore the leap second
  • smear - spread the correction over several hours
  • system - use the system’s handling
  • timezone - use timezone data

Recommended:

set service ntp leap-second smear

Hardware Timestamping

Hardware timestamps for improved accuracy:

set service ntp timestamp interface eth0

Filter options:

set service ntp timestamp interface eth0 receive-filter all

Filter modes:

  • all - all packets
  • ntp - NTP only
  • ptp - PTP only
  • none - no hardware timestamps

VRF Support

Running NTP in a specific VRF:

set service ntp vrf MGMT

Configuration examples

Basic NTP client

# Synchronization with public servers
set service ntp server 0.pool.ntp.org
set service ntp server 1.pool.ntp.org
set service ntp server time.google.com prefer

commit

NTP server for a local network

# Upstream servers
set service ntp server 0.pool.ntp.org
set service ntp server 1.pool.ntp.org
set service ntp server 2.pool.ntp.org

# Listen on the LAN interface
set service ntp listen-address '192.168.1.1'

# Allow clients from the LAN
set service ntp allow-client address '192.168.1.0/24'

commit

Enterprise configuration

# Corporate NTP servers
set service ntp server ntp1.corp.local prefer
set service ntp server ntp2.corp.local
set service ntp server ntp3.corp.local

# Public fallbacks
set service ntp server time.google.com
set service ntp server time.cloudflare.com nts

# Server for subnets
set service ntp listen-address '192.168.10.1'
set service ntp listen-address '192.168.20.1'

# Allow corporate networks
set service ntp allow-client address '192.168.0.0/16'
set service ntp allow-client address '10.0.0.0/8'

# Leap second
set service ntp leap-second smear

commit

High-precision NTP

# Stratum 1 servers
set service ntp server ntp1.example.com interleave
set service ntp server ntp2.example.com interleave
set service ntp server ntp3.example.com interleave

# Hardware timestamping
set service ntp timestamp interface eth0
set service ntp timestamp interface eth0 receive-filter ntp

commit

Regional configuration (Russia)

# Russian NTP servers
set service ntp server 0.ru.pool.ntp.org pool
set service ntp server 1.ru.pool.ntp.org pool
set service ntp server ntp.ix.ru
set service ntp server ntp1.vniiftri.ru
set service ntp server ntp2.vniiftri.ru

# Global fallbacks
set service ntp server time.google.com

# Local server
set service ntp listen-address '192.168.1.1'
set service ntp allow-client address '192.168.1.0/24'

commit

Multi-site with VRF

# Management VRF
set service ntp vrf MGMT

# Upstream in the management network
set service ntp server 10.0.0.10
set service ntp server 10.0.0.11

# Listen in management
set service ntp listen-address '10.0.1.1'
set service ntp allow-client address '10.0.0.0/8'

commit

Secure NTP with NTS

# NTS-only servers
set service ntp server time.cloudflare.com nts
set service ntp server ntppool1.time.nl nts
set service ntp server nts.ntp.se nts

# Leap second
set service ntp leap-second smear

commit

Operational commands

Viewing synchronization status

show ntp

The output shows:

  • The current synchronization state
  • The list of servers and their status
  • The stratum level
  • Offset (time offset)
  • Jitter

NTP information

show ntp info

Detailed information about the NTP daemon.

Time sources

show ntp sources

A list of all upstream NTP servers.

Statistics

show ntp activity

NTP activity statistics.

Restarting the service

restart ntp

Monitoring and diagnostics

Checking synchronization

show ntp

Pay attention to:

  • The * symbol in front of a server indicates the current synchronization source
  • Offset should be close to zero (< 10ms under normal conditions)
  • Jitter should be low (< 5ms is good)

Logs

show log | grep ntp
monitor log | grep chronyd

Checking server availability

From the client:

ntpdate -q 192.168.1.1

or

chronyc -h 192.168.1.1 tracking

Checking the firewall

Make sure UDP port 123 is open:

show firewall ipv4 input filter

Troubleshooting

Time is not synchronizing

Check the status:

show ntp

Check the availability of upstream servers:

ping 0.pool.ntp.org

Check the firewall on the WAN:

show firewall ipv4 output filter

Restart NTP:

restart ntp

Large time offset

If the offset is > 1 second, a manual time setting may be required:

set system time-zone UTC

Or use ntpdate for the initial synchronization.

The NTP server does not respond to clients

Check allow-client:

show service ntp

Check the firewall:

set firewall ipv4 input filter rule 50 action accept
set firewall ipv4 input filter rule 50 destination port 123
set firewall ipv4 input filter rule 50 protocol udp
set firewall ipv4 input filter rule 50 source address 192.168.1.0/24
commit

Check listen-address:

show service ntp

Conflict with systemd-timesyncd

chrony conflicts with systemd-timesyncd. Make sure only one service is running.

Security

Restricting clients

Always use allow-client:

set service ntp allow-client address '192.168.1.0/24'

Firewall rules

# Incoming NTP requests
set firewall ipv4 input filter rule 50 action accept
set firewall ipv4 input filter rule 50 destination port 123
set firewall ipv4 input filter rule 50 protocol udp
set firewall ipv4 input filter rule 50 source address 192.168.1.0/24

# Outgoing for synchronization
set firewall ipv4 output filter rule 50 action accept
set firewall ipv4 output filter rule 50 destination port 123
set firewall ipv4 output filter rule 50 protocol udp

Rate limiting

Protection against NTP amplification attacks:

set firewall ipv4 input filter rule 50 limit rate 10/second

NTS

Use Network Time Security wherever possible:

set service ntp server time.cloudflare.com nts

Best practices

  1. Multiple sources - use at least 3-4 NTP servers
  2. Geographic proximity - choose servers close to your location
  3. Stratum diversity - use servers of different stratum levels
  4. prefer server - choose the most reliable one as preferred
  5. Redundancy - combine local and public servers
  6. Firewall - restrict access to the NTP service
  7. Monitoring - track offset and jitter regularly
  8. NTS - use it where available for security
  9. Leap second - configure handling for critical systems
  10. Hardware timestamping - enable it for high accuracy

Stratum hierarchy

  • Stratum 0 - Atomic clocks, GPS (reference clocks)
  • Stratum 1 - Servers directly connected to Stratum 0
  • Stratum 2 - Servers synchronized with Stratum 1
  • Stratum 3-15 - Subsequent levels

VyOS typically operates as Stratum 3-4 when synchronizing with public servers.

Performance

Typical accuracy:

  • LAN: ±1ms
  • WAN: ±10ms
  • Internet: ±50ms
  • With hardware timestamping: ±10μs (microseconds)

Next steps

Reviewed by OpenNix LLC · Last updated on
SSH ServerHTTPS API