Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wanted to tighten my security so I don't want to open any ports that are not really needed. I have no intentions of running an ntp server for other people to use, I only run the ntp daemon to keep the local clock synced, so I added these two lines to my /etc/ntp.conf:

interface ignore wildcard
interface listen lo

But after that, ntpd seems not to be able to reach servers, as experienced by:

# ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
 secondary.cleve .INIT.          16 -    -   64    0    0.000    0.000   0.000 .INIT.          16 -    -   64    0    0.000    0.000   0.000 .INIT.          16 -    -   64    0    0.000    0.000   0.000
 rigel.retrosnub .INIT.          16 -    -   64    0    0.000    0.000   0.000
 europium.canoni .INIT.          16 -    -   64    0    0.000    0.000   0.000

It seems that configuration is making nptd not use those interfaces at all, not even to connect to other servers.

Does ntpd need to listen on external interfaces to be able sync the clock?

share|improve this question
Please edit your post and add your full ntp.conf. – dfc Mar 26 '14 at 14:58

As far as I can tell, ignore means don't open the adress/port, drop means open but ignore any and all traffic (though it might be able to use them still). So yeah, it seems to need the interface bound..


share|improve this answer

I like to push "no-firewall-safe" configs even when I'm behind them, so I find it frustrating when a package doesn't offer control over interface binding. There is at least one alternative in (old) . For "classic" ntpd, has a short labyrinth of recommendations, which can be tested using your favorite queries (e.g. ntpdate from another host, check_ntp from the Nagios plugin suite, etc.).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.