NTP server does not work

Installing and Using OpenWrt
1

For some weird reason my OpenWrt router does not serve time to LAN hosts. The configurations of this router are so basic that I can't believe I have to create this topic.

/etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd60:8825:2c7f::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.78.11'
	option netmask '255.255.255.0'

config interface 'wan'
	option device 'wan'
	option proto 'static'
	option ipaddr '192.168.100.100'
	option netmask '255.255.255.0'
	option gateway '192.168.100.1'
	list dns '94.140.15.15'
	option metric '10'

config interface 'wan79'
	option device 'lan2'
	option proto 'static'
	list ipaddr '192.168.79.11/24'
	option gateway '192.168.79.1'
	list dns '94.140.15.15'
	option defaultroute '1'
	option metric '20'

/etc/config/firewall

config defaults
	option syn_flood	1
	option input		REJECT
	option output		ACCEPT
	option forward		REJECT
# Uncomment this line to disable ipv6 rules
#	option disable_ipv6	1

config zone
	option name		lan
	list   network		'lan'
	option input		ACCEPT
	option output		ACCEPT
	option forward		ACCEPT

config zone
	option name		wan
	list   network		'wan'
	list   network		'wan6'
	list network 'wan79'
	option input		ACCEPT
	option output		ACCEPT
	option forward		REJECT
	option masq		1
	option mtu_fix		1

config forwarding
	option src		lan
	option dest		wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
	option name		Allow-DHCP-Renew
	option src		wan
	option proto		udp
	option dest_port	68
	option target		ACCEPT
	option family		ipv4

# Allow IPv4 ping
config rule
	option name		Allow-Ping
	option src		wan
	option proto		icmp
	option icmp_type	echo-request
	option family		ipv4
	option target		ACCEPT

config rule
	option name		Allow-IGMP
	option src		wan
	option proto		igmp
	option family		ipv4
	option target		ACCEPT

# Allow DHCPv6 replies
# see https://github.com/openwrt/openwrt/issues/5066
config rule
	option name		Allow-DHCPv6
	option src		wan
	option proto		udp
	option dest_port	546
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-MLD
	option src		wan
	option proto		icmp
	option src_ip		fe80::/10
	list icmp_type		'130/0'
	list icmp_type		'131/0'
	list icmp_type		'132/0'
	list icmp_type		'143/0'
	option family		ipv6
	option target		ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Input
	option src		wan
	option proto	icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	list icmp_type		router-solicitation
	list icmp_type		neighbour-solicitation
	list icmp_type		router-advertisement
	list icmp_type		neighbour-advertisement
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Forward
	option src		wan
	option dest		*
	option proto		icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-IPSec-ESP
	option src		wan
	option dest		lan
	option proto		esp
	option target		ACCEPT

config rule
	option name		Allow-ISAKMP
	option src		wan
	option dest		lan
	option dest_port	500
	option proto		udp
	option target		ACCEPT

/etc/config/system

config system
	option hostname 'OpenWrt'
	option timezone 'UTC'
	option ttylogin '0'
	option log_size '64'
	option urandom_seed '0'
#	option compat_version '1.1'

config timeserver 'ntp'
	option enabled '1'
	option enable_server '1'
	list server '0.openwrt.pool.ntp.org'
	list server '1.openwrt.pool.ntp.org'
	list server '2.openwrt.pool.ntp.org'
	list server '3.openwrt.pool.ntp.org'

config led 'led_wan'
	option name 'WAN'
	option sysfs 'blue:wan'
	option trigger 'netdev'
	option mode 'link tx rx'
	option dev 'wan'

config led 'led_lan1'
	option name 'LAN1'
	option sysfs 'blue:lan1'
	option trigger 'netdev'
	option mode 'link tx rx'
	option dev 'lan1'

config led 'led_lan2'
	option name 'LAN2'
	option sysfs 'blue:lan2'
	option trigger 'netdev'
	option mode 'link tx rx'
	option dev 'lan2'

There are no significant changes to the packages on the system. It is merely a router which I am playing around with tinyproxy, and it is the only additional package that I installed. Everything else is default.

From a LAN host with the address 192.168.78.4:

$ ntpdate -q 192.168.78.11
ntpdig: no eligible servers
1 Like
2

what is the output of netstat -plnu -- ideally we should se ntpd running on port 123.

3

Looks like there is nothing running:

root@OpenWrt:~# netstat -plnu
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
root@OpenWrt:~#

On my other OpenWrt router:

root@fw0001:~# netstat -plnu
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
udp        0      0 192.168.9.2:53          0.0.0.0:*                           3212/dnsmasq
udp        0      0 127.0.0.1:53            0.0.0.0:*                           3212/dnsmasq
udp        0      0 14.160.34.242:53        0.0.0.0:*                           3212/dnsmasq
udp        0      0 10.232.32.38:53         0.0.0.0:*                           3212/dnsmasq
udp        0      0 192.168.79.1:53         0.0.0.0:*                           3212/dnsmasq
udp        0      0 0.0.0.0:67              0.0.0.0:*                           3212/dnsmasq
udp        0      0 0.0.0.0:61820           0.0.0.0:*                           -
udp        0      0 :::546                  :::*                                3536/odhcp6c
udp        0      0 :::547                  :::*                                1874/odhcpd
udp        0      0 fd00:9::2:53            :::*                                3212/dnsmasq
udp        0      0 fe80::21a:92ff:fe81:82e7:53 :::*                                3212/dnsmasq
udp        0      0 fdc2:df05:4a7c:b4e:841:f89d:3db4:f0c:53 :::*                                3212/dnsmasq
udp        0      0 ::1:53                  :::*                                3212/dnsmasq
udp        0      0 fdc2:df05:4a7c::1:53    :::*                                3212/dnsmasq
udp        0      0 fe80::eade:27ff:fe03:de14:53 :::*                                3212/dnsmasq
udp        0      0 :::123                  :::*                                2517/ntpd
udp        0      0 :::61820                :::*                                -
root@fw0001:~#
4

So you've got two OpenWrt routers... one working, one not.

What is the output of the non-working one for this:

ubus call system board
5

Here it is:

root@OpenWrt:~# ubus call system board
{
	"kernel": "5.15.167",
	"hostname": "OpenWrt",
	"system": "ARMv7 Processor rev 5 (v7l)",
	"model": "MobiPromo CM520-79F",
	"board_name": "mobipromo,cm520-79f",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.5",
		"revision": "r24106-10cc5fcd00",
		"target": "ipq40xx/generic",
		"description": "OpenWrt 23.05.5 r24106-10cc5fcd00"
	}
}
6

I don't know that it will change anything, but try removing option enabled '1' from below.

Then restart the router and test again.

7

It works after a simple restart. :face_with_spiral_eyes:

I did not remove the option enabled '1'. My configurations are usually well-tested in a production environment, then I simply copy the snippet to other routers to avoid unnecessary errors.

The reason I almost never reboot this router is because it is serving as a web proxy in a production environment too. :expressionless:

I've checked BusyBox sysntpd service. It is still enabled by default. Maybe it stopped working without my notice earlier. It is a little strange because I had tried service system restart multiple times before that, yet it did not work.

Much appreciate your help, psherman.

1 Like
8

Just curious. Do you have the NTP server set as a DHCP option in the LAN interface?

image
image1022×568 45.1 KB

9

I've noticed it will sometimes stop working even though it's still running. No errors or anything.

I just restart it nightly to solve.

10

Windows does not accept DHCP option 42, due to security concern. If it does, a rogue DHCP server can change time of all hosts and servers in the subnet. The time server must be set manually on each Windows PC.

By default OpenWrt does not offer option 42 either.

1 Like
11

I have found this to always be the case.
The ntpd daemon is what does the work.
Restarting the system does not restart ntpd (ie service system restart).
To have ntpd to also function as a server it must be restarted with option -l
ie ntpd -l .....
Setting option enabled '1' enables the "-l" but only a reboot (or a manual kill [ntpd-pid]) will work in starting the server.

root@meshnode-8ecb:~# ntpd --help
BusyBox v1.37.0 (2024-12-16 00:46:38 UTC) multi-call binary.

Usage: ntpd [-dnqNwl] [-I IFACE] [-S PROG] [-p PEER]...

NTP client/server

	-d[d]	Verbose
	-n	Run in foreground
	-q	Quit after clock is set
	-N	Run at high priority
	-w	Do not set time (only query peers), implies -n
	-S PROG	Run PROG after stepping time, stratum change, and every 11 min
	-p PEER	Obtain time from PEER (may be repeated)
	-l	Also run as server on port 123
	-I IFACE Bind server to IFACE, implies -l
root@meshnode-8ecb:~#
1 Like
12

I just use /etc/init.d/sysntpd restart

1 Like