Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to sync the clock of our production server located in a data center with pool.ntp.org. For security reason, our servers has no internet access unless we requested to open specific ip/port explicitly. I worked out a list of IPs based on

0.asia.ntp.org
1.asia.ntp.org
2.asia.ntp.org
3.asia.ntp.org

Not realizing ntp.org is using round robin DNS and the servers being voluntary, they changes from time to time. In fact the IP I've got from 3.asia.ntp.org last month is no longer working now.

I'm wondering if there's a publicly known NTP server that doesn't change as often or if there's a way to go around this without having to request an update to the firewall on a monthly basis. I believe many admin is facing the same issue here.

share|improve this question
5  
Call your ISP. They probably have a local NTP server on a fixed IP that you can use, and they will have the smallest latency/jitter. Many ISPs have a NTP server, they just don't advertise it very much. –  Zoredache Sep 6 '12 at 1:38
2  
Or you can setup one or two NTP servers of your own (perhaps in a DMZ), have those synchronize with pool.ntp.org, and point your production server to your owhn NTP server(s). –  Ansgar Wiechers Sep 6 '12 at 2:29

1 Answer 1

up vote 3 down vote accepted

ntp.org provides a list of primary and secondary time servers. I think it's reasonable to assume these will generally be static addresses, especially compared to the NTP pool which intentionally rotates every hour.

Please note that not all are open/public access and abide by the rules of engagement, which suggest using secondary servers over primary among other things.

share|improve this answer
    
I once ran a script that did lookups on some of those pool addresses and collected the IP addresses every hour. After a couple weeks I had collected over 200 addresses. This is not a practical resource in limited IP access situation. The ISP time servers should be used. Any decent colo provider has a couple of them. –  Skaperen Sep 6 '12 at 4:05
    
Thanks, I found that some of the servers has Use DNS = No, which means IP would most like be static. –  faulty Sep 6 '12 at 11:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.