NTP & Time

Network time synchronisation (ntpd), constraints, optional NTP server mode, the system timezone, and the log-timestamp mode.

Sync — Daemon — Stratum — Peers —

System time: — (— UTC) · constraint offset —

Time sources

Synchronise the clock from the sources below

NTP pools resolve to several rotating servers; a server is a single host. Most routers need one or two pools.

Constraints (TLS time check)

Cross-checks NTP answers against the time in an HTTPS server's TLS handshake, so a spoofed NTP reply can't move the clock far. dhcp uses the constraint URL handed out by DHCP; url pins your own HTTPS host.

Verify NTP against a TLS constraint

From a URL From DHCP

Constraint URL

Serve NTP to the network

Answer NTP queries from clients (ntpd listen on)

Security: serving NTP on a WAN / internet-facing address turns this router into an NTP amplification reflector that attackers can abuse to flood third parties. Serve only on internal (LAN) addresses, and firewall UDP 123 from the WAN.

Pick the addresses to listen on (ntpd binds to IP addresses, not interface names). Leave all unchecked to serve on every address — not recommended.

Additional addresses (comma or space separated) {{#WAN_CONFIRM}} Serve NTP on the WAN interface ({{WAN_IF}}, the default route) — I understand the amplification risk and have firewalled UDP 123 from the internet. {{/WAN_CONFIRM}}

Timezone

System timezone

Log timestamps

Local time UTC

Local routers: use local time; global estates: use UTC for consistent cross-site log correlation.

Rendered `ntpd.conf`

{{RENDERED_PREVIEW}}