我正在尝试为本地networking设置NTP服务器，但ntpd拒绝与外部服务器同步。
# ntptrace localhost: stratum 16, offset 0.000000, synch distance 0.396285 # ntpq -pn remote refid st t when poll reach delay offset jitter ============================================================================== 31.135.95.60 .INIT. 16 u - 1024 0 0.000 0.000 0.000 31.131.249.26 .INIT. 16 u - 1024 0 0.000 0.000 0.000 91.122.42.73 .INIT. 16 u - 1024 0 0.000 0.000 0.000 194.190.168.1 .INIT. 16 u - 1024 0 0.000 0.000 0.000 我使用的configuration是非常默认的：
# grep ^[^#] /etc/ntp.conf server 0.gentoo.pool.ntp.org server 1.gentoo.pool.ntp.org server 2.gentoo.pool.ntp.org server 3.gentoo.pool.ntp.org driftfile /var/lib/ntp/ntp.drift restrict default nomodify nopeer noquery limited kod restrict 127.0.0.1 restrict [::1] restrict 192.168.0.0 mask 255.255.255.0 nomodify nopeer notrap disable monitor
奇怪的是，我有局域网内的另一个NTP服务器，工作和同步好，所以我没有责怪123 UDP端口，但要确保我已经明确打开它在我试图起床的网关NTPD。
# iptables -L -n -v Chain INPUT (policy ACCEPT 839K packets, 836M bytes) pkts bytes target prot opt in out source destination 31696 3023K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 3435 273K ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 0 0 REJECT udp -- !br0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:67 reject-with icmp-port-unreachable 0 0 REJECT udp -- !br0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 reject-with icmp-port-unreachable 0 0 ACCEPT tcp -- br1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 0 0 ACCEPT tcp -- br1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 0 0 ACCEPT tcp -- br1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21 0 0 ACCEPT tcp -- br1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 0 0 ACCEPT tcp -- br1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:123 0 0 DROP tcp -- br1 * 0.0.0.0/0 0.0.0.0/0 tcp dpts:0:1023 204 15504 DROP udp -- br1 * 0.0.0.0/0 0.0.0.0/0 udp dpts:0:1023 0 0 DROP tcp -- br1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2049 0 0 DROP udp -- br1 * 0.0.0.0/0 0.0.0.0/0 udp dpt:2049 0 0 DROP tcp -- br1 * 0.0.0.0/0 0.0.0.0/0 tcp dpts:32765:32768 0 0 DROP udp -- br1 * 0.0.0.0/0 0.0.0.0/0 udp dpts:32765:32768 Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 DROP all -- br0 * 0.0.0.0/0 192.168.0.0/16 21579 1859K ACCEPT all -- br0 * 192.168.0.0/16 0.0.0.0/0 21307 6910K ACCEPT all -- br1 * 0.0.0.0/0 192.168.0.0/16 Chain OUTPUT (policy ACCEPT 762K packets, 151M bytes) pkts bytes target prot opt in out source destination
br0是局域网，而br1是广域网。
尝试连接到第2层服务器（在其他服务器上可以看到ntpd工作正常）：
# ntpdate -d 95.213.132.250 2 May 07:35:30 ntpdate[9987]: ntpdate [email protected] Fri May 1 20:36:27 UTC 2015 (1) transmit(95.213.132.250) receive(95.213.132.250) transmit(95.213.132.250) receive(95.213.132.250) transmit(95.213.132.250) receive(95.213.132.250) transmit(95.213.132.250) receive(95.213.132.250) server 95.213.132.250, port 123 stratum 2, precision -21, leap 00, trust 000 refid [95.213.132.250], delay 0.03688, dispersion 0.00314 transmitted 4, in filter 4 reference time: d8eeccd9.08f19253 Sat, May 2 2015 7:11:05.034 originate timestamp: d8eed298.9d09bba6 Sat, May 2 2015 7:35:36.613 transmit timestamp: d8eed298.9ae29d48 Sat, May 2 2015 7:35:36.605 filter delay: 0.04114 0.04720 0.04874 0.03688 0.00000 0.00000 0.00000 0.00000 filter offset: 0.004748 0.008231 0.008865 0.002733 0.000000 0.000000 0.000000 0.000000 delay 0.03688, dispersion 0.00314 offset 0.002733 2 May 07:35:36 ntpdate[9987]: adjust time server 95.213.132.250 offset 0.002733 sec
尝试从ntpd获得一些输出
# ntpd -gqd 2 May 07:45:35 ntpd[20292]: ntpd [email protected] Fri May 1 20:36:26 UTC 2015 (1): Starting 2 May 07:45:35 ntpd[20292]: Command line: ntpd -gqd 2 May 07:45:35 ntpd[20292]: proto: precision = 0.051 usec (-24) 2 May 07:45:35 ntpd[20292]: Listen and drop on 0 v4wildcard 0.0.0.0:123 2 May 07:45:35 ntpd[20292]: Listen normally on 1 lo 127.0.0.1:123 2 May 07:45:35 ntpd[20292]: Listen normally on 2 br0 192.168.0.1:123 2 May 07:45:35 ntpd[20292]: Listen normally on 3 br0 192.168.0.9:123 2 May 07:45:35 ntpd[20292]: Listen normally on 4 br0 192.168.0.17:123 2 May 07:45:35 ntpd[20292]: Listen normally on 5 br1 192.168.42.250:123 2 May 07:45:35 ntpd[20292]: Listening on routing socket on fd #22 for interface updates 2 May 07:45:35 ntpd[20292]: restrict: ignoring line 51, address/host '[::1]' unusable. ^C 2 May 07:45:44 ntpd[20292]: ntpd exiting on signal 2 (Interrupt) 2 May 07:45:44 ntpd[20292]: 46.8.40.31 local addr 192.168.42.250 -> <null> 2 May 07:45:44 ntpd[20292]: 217.70.19.12 local addr 192.168.42.250 -> <null> 2 May 07:45:44 ntpd[20292]: 89.208.145.140 local addr 192.168.42.250 -> <null> 2 May 07:45:44 ntpd[20292]: 31.135.95.60 local addr 192.168.42.250 -> <null>
由于开始时可以看到^C ，守护进程是手动进行的，因为它不会退出，因为它应该（另一个服务器ntpd在报告时间结束后，在限制消息之后退出）
无论我做什么，经过许多重新启动，漂移不会改变：
# cat /var/lib/ntp/ntp.drift -7.037
您的防火墙规则不允许NTP。 该线
0 0 ACCEPT tcp -- br1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:123
都很好，但是NTP是一个UDP服务。 改变协议，事情会变得更好。 你的FORWARD规则要宽松得多（本质上是permit any any ），这就是为什么LAN内的主机同步OK的原因。