How to configure UFW to allow ntp to work?
I've enabled UFW on one of production servers with configuration: Default: deny (incoming), deny (outgoing). For NTP synchronization, I've installed ntp
and it's currently running.
Can someone advise what rule should be added to UFW for NTP synchronization? I've read somewhere that udp port 123
needs to be open for ntp, but when I run ntpq -p
, I get following output:
remote refid st t when poll reach delay offset jitter
==============================================================================
propjet.latt.ne 187.253.153.32 2 u 4d 1024 0 81.243 9.054 0.000
ec2-107-20-168- 130.207.244.240 2 u 4d 1024 0 86.669 -23.040 0.000
utcnist2.colora .ACTS. 1 u 4d 1024 0 298.151 86.936 0.000
which indicates that I don't need to add any ufw rule and ntp is already working?
With a simple
sudo ufw allow ntp
You can use all services listed in /etc/services
sudo ufw allow <service name>
With the following rules-set, NTP-synchronization is working perfectly for me:
sudo ufw allow 123/udp
sudo ufw allow out 123/udp
sudo ufw allow out 53
I've allowed UDP port 123 for both incoming and outgoing traffic to NTP work. Additionally I also needed to open TCP port 53 (DNS) for outgoing traffic since /etc/ntp.conf
contains domain names of NTP servers. .