# NTP Service

> Configure NTP on VyOS: time synchronization, NTP client and server, stratum hierarchy, chrony, NTS security for Yandex Cloud and VK Cloud

Source: https://opennix.org/en/docs/vyos/services/vyos-ntp/


NTP (Network Time Protocol) is a protocol for synchronizing the clocks of computer systems over a network.

## Overview

VyOS uses chrony (starting from version 1.4) to implement the NTP client and server.

NTP provides:
- System time synchronization with millisecond accuracy
- Automatic time correction
- Leap second handling
- A hierarchical system of time servers (stratum)
- Simultaneous operation as both a client and a server

**Protocol**: UDP port 123

**Current version**: NTPv4 (RFC 5905)

## Basic configuration

### NTP client

Synchronization with public NTP servers:

```
set service ntp server 0.pool.ntp.org
set service ntp server 1.pool.ntp.org
set service ntp server 2.pool.ntp.org
commit
```

By default, VyOS uses:
- time1.vyos.net
- time2.vyos.net
- time3.vyos.net

### NTP server

Allowing clients to synchronize with VyOS:

```
set service ntp listen-address '192.168.1.1'
set service ntp allow-client address '192.168.1.0/24'
commit
```

## NTP server configuration

### Adding a server

```
set service ntp server <hostname|IP>
```

Examples:
```
set service ntp server pool.ntp.org
set service ntp server time.google.com
set service ntp server 216.239.35.0
```

### Server options

#### prefer - Preferred server

Server priority when selecting a time source:

```
set service ntp server 0.pool.ntp.org prefer
```

#### noselect - Do not use for synchronization

The server is monitored but not used:

```
set service ntp server backup.ntp.org noselect
```

#### pool - Pool mode

Automatic name resolution and addition of multiple servers:

```
set service ntp server pool.ntp.org pool
```

A single DNS query can return multiple IP addresses, and all of them will be used.

#### nts - Network Time Security

Encrypted NTP connection:

```
set service ntp server time.cloudflare.com nts
```

NTS provides authentication and confidentiality for NTP traffic.

#### ptp - PTP Transport

Using the Precision Time Protocol transport:

```
set service ntp server ntp.example.com ptp
```

#### interleave - Interleaved Mode

Improved synchronization accuracy:

```
set service ntp server ntp.example.com interleave
```

## NTP Pool

### Public NTP Pools

**NTP Pool Project** (pool.ntp.org):
```
set service ntp server 0.pool.ntp.org
set service ntp server 1.pool.ntp.org
set service ntp server 2.pool.ntp.org
set service ntp server 3.pool.ntp.org
```

**Regional pools**:
```
# Russia
set service ntp server 0.ru.pool.ntp.org
set service ntp server 1.ru.pool.ntp.org

# Europe
set service ntp server 0.europe.pool.ntp.org
set service ntp server 1.europe.pool.ntp.org

# North America
set service ntp server 0.north-america.pool.ntp.org
```

**Vendor-specific**:
```
# Debian
set service ntp server 0.debian.pool.ntp.org

# Ubuntu
set service ntp server ntp.ubuntu.com
```

### Major providers

**Google Public NTP**:
```
set service ntp server time.google.com
set service ntp server time1.google.com
set service ntp server time2.google.com
set service ntp server time3.google.com
set service ntp server time4.google.com
```

**Cloudflare NTP** (with NTS):
```
set service ntp server time.cloudflare.com nts
```

**Facebook NTP**:
```
set service ntp server time.facebook.com
```

## NTP Server Configuration

### Listen Address

Addresses to listen for NTP requests on:

```
set service ntp listen-address '192.168.1.1'
set service ntp listen-address '10.0.0.1'
set service ntp listen-address '2001:db8::1'
```

By default, it listens on all interfaces.

### Allow Client

Allowing clients to synchronize:

```
set service ntp allow-client address '192.168.1.0/24'
set service ntp allow-client address '10.0.0.0/8'
set service ntp allow-client address '2001:db8::/32'
```

Without `allow-client`, the server will only synchronize itself but will not serve clients.

## Leap Second

Handling leap seconds:

```
set service ntp leap-second <mode>
```

Modes:

- **ignore** - ignore the leap second
- **smear** - spread the correction over several hours
- **system** - use the system's handling
- **timezone** - use timezone data

Recommended:
```
set service ntp leap-second smear
```

## Hardware Timestamping

Hardware timestamps for improved accuracy:

```
set service ntp timestamp interface eth0
```

Filter options:

```
set service ntp timestamp interface eth0 receive-filter all
```

Filter modes:
- **all** - all packets
- **ntp** - NTP only
- **ptp** - PTP only
- **none** - no hardware timestamps

## VRF Support

Running NTP in a specific VRF:

```
set service ntp vrf MGMT
```

## Configuration examples

### Basic NTP client

```
# Synchronization with public servers
set service ntp server 0.pool.ntp.org
set service ntp server 1.pool.ntp.org
set service ntp server time.google.com prefer

commit
```

### NTP server for a local network

```
# Upstream servers
set service ntp server 0.pool.ntp.org
set service ntp server 1.pool.ntp.org
set service ntp server 2.pool.ntp.org

# Listen on the LAN interface
set service ntp listen-address '192.168.1.1'

# Allow clients from the LAN
set service ntp allow-client address '192.168.1.0/24'

commit
```

### Enterprise configuration

```
# Corporate NTP servers
set service ntp server ntp1.corp.local prefer
set service ntp server ntp2.corp.local
set service ntp server ntp3.corp.local

# Public fallbacks
set service ntp server time.google.com
set service ntp server time.cloudflare.com nts

# Server for subnets
set service ntp listen-address '192.168.10.1'
set service ntp listen-address '192.168.20.1'

# Allow corporate networks
set service ntp allow-client address '192.168.0.0/16'
set service ntp allow-client address '10.0.0.0/8'

# Leap second
set service ntp leap-second smear

commit
```

### High-precision NTP

```
# Stratum 1 servers
set service ntp server ntp1.example.com interleave
set service ntp server ntp2.example.com interleave
set service ntp server ntp3.example.com interleave

# Hardware timestamping
set service ntp timestamp interface eth0
set service ntp timestamp interface eth0 receive-filter ntp

commit
```

### Regional configuration (Russia)

```
# Russian NTP servers
set service ntp server 0.ru.pool.ntp.org pool
set service ntp server 1.ru.pool.ntp.org pool
set service ntp server ntp.ix.ru
set service ntp server ntp1.vniiftri.ru
set service ntp server ntp2.vniiftri.ru

# Global fallbacks
set service ntp server time.google.com

# Local server
set service ntp listen-address '192.168.1.1'
set service ntp allow-client address '192.168.1.0/24'

commit
```

### Multi-site with VRF

```
# Management VRF
set service ntp vrf MGMT

# Upstream in the management network
set service ntp server 10.0.0.10
set service ntp server 10.0.0.11

# Listen in management
set service ntp listen-address '10.0.1.1'
set service ntp allow-client address '10.0.0.0/8'

commit
```

### Secure NTP with NTS

```
# NTS-only servers
set service ntp server time.cloudflare.com nts
set service ntp server ntppool1.time.nl nts
set service ntp server nts.ntp.se nts

# Leap second
set service ntp leap-second smear

commit
```

## Operational commands

### Viewing synchronization status

```
show ntp
```

The output shows:
- The current synchronization state
- The list of servers and their status
- The stratum level
- Offset (time offset)
- Jitter

### NTP information

```
show ntp info
```

Detailed information about the NTP daemon.

### Time sources

```
show ntp sources
```

A list of all upstream NTP servers.

### Statistics

```
show ntp activity
```

NTP activity statistics.

### Restarting the service

```
restart ntp
```

## Monitoring and diagnostics

### Checking synchronization

```
show ntp
```

Pay attention to:
- **The `*` symbol** in front of a server indicates the current synchronization source
- **Offset** should be close to zero (< 10ms under normal conditions)
- **Jitter** should be low (< 5ms is good)

### Logs

```
show log | grep ntp
monitor log | grep chronyd
```

### Checking server availability

From the client:
```bash
ntpdate -q 192.168.1.1
```

or

```bash
chronyc -h 192.168.1.1 tracking
```

### Checking the firewall

Make sure UDP port 123 is open:
```
show firewall ipv4 input filter
```

## Troubleshooting

### Time is not synchronizing

Check the status:
```
show ntp
```

Check the availability of upstream servers:
```
ping 0.pool.ntp.org
```

Check the firewall on the WAN:
```
show firewall ipv4 output filter
```

Restart NTP:
```
restart ntp
```

### Large time offset

If the offset is > 1 second, a manual time setting may be required:
```
set system time-zone UTC
```

Or use ntpdate for the initial synchronization.

### The NTP server does not respond to clients

Check `allow-client`:
```
show service ntp
```

Check the firewall:
```
set firewall ipv4 input filter rule 50 action accept
set firewall ipv4 input filter rule 50 destination port 123
set firewall ipv4 input filter rule 50 protocol udp
set firewall ipv4 input filter rule 50 source address 192.168.1.0/24
commit
```

Check `listen-address`:
```
show service ntp
```

### Conflict with systemd-timesyncd

chrony conflicts with systemd-timesyncd. Make sure only one service is running.

## Security

### Restricting clients

Always use `allow-client`:
```
set service ntp allow-client address '192.168.1.0/24'
```

### Firewall rules

```
# Incoming NTP requests
set firewall ipv4 input filter rule 50 action accept
set firewall ipv4 input filter rule 50 destination port 123
set firewall ipv4 input filter rule 50 protocol udp
set firewall ipv4 input filter rule 50 source address 192.168.1.0/24

# Outgoing for synchronization
set firewall ipv4 output filter rule 50 action accept
set firewall ipv4 output filter rule 50 destination port 123
set firewall ipv4 output filter rule 50 protocol udp
```

### Rate limiting

Protection against NTP amplification attacks:
```
set firewall ipv4 input filter rule 50 limit rate 10/second
```

### NTS

Use Network Time Security wherever possible:
```
set service ntp server time.cloudflare.com nts
```

## Best practices

1. **Multiple sources** - use at least 3-4 NTP servers
2. **Geographic proximity** - choose servers close to your location
3. **Stratum diversity** - use servers of different stratum levels
4. **prefer server** - choose the most reliable one as preferred
5. **Redundancy** - combine local and public servers
6. **Firewall** - restrict access to the NTP service
7. **Monitoring** - track offset and jitter regularly
8. **NTS** - use it where available for security
9. **Leap second** - configure handling for critical systems
10. **Hardware timestamping** - enable it for high accuracy

## Stratum hierarchy

- **Stratum 0** - Atomic clocks, GPS (reference clocks)
- **Stratum 1** - Servers directly connected to Stratum 0
- **Stratum 2** - Servers synchronized with Stratum 1
- **Stratum 3-15** - Subsequent levels

VyOS typically operates as Stratum 3-4 when synchronizing with public servers.

## Performance

Typical accuracy:
- **LAN**: ±1ms
- **WAN**: ±10ms
- **Internet**: ±50ms
- **With hardware timestamping**: ±10μs (microseconds)

## Next steps

- [System Time Zone](/docs/vyos/system/vyos-timezone/) - configuring the time zone
- [Firewall](/docs/vyos/firewall/) - protecting the NTP service
- [Monitoring](/docs/vyos/services/) - monitoring NTP metrics