I have a NAT server that's in my VPC's public subnet on AWS. It's pretty happy with its NTP setup so I thought, no problem, let's get all my private subnets using this server as their designated time syncing server.

If in /etc/ntp.conf I set the server to my NAT instance's Public DNS everything works dandy. However, if I set it to the NAT instance's Public IP address it doesn't ever make a connection. For example, if a run ntpdate I get no servers can be used.

Regardless if the /etc/ntp.conf is set to the public IP or public DNS if I run ntpq -p, I see that the remote address is pointing to the Public DNS not the IP (not that I see why that would matter unless literal pattern matching is occurring between the IP and the DNS and that's failing which is the cause of this).

I researched this trying to see if it was explicitly stated somewhere that IPs were just a no-go, but I actually found the exact opposite stated.

Add an entry for each server to poll for time synchronization. You can use a DNS name for this entry or a dotted quad IP address (such as http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-time.html

Admittedly that's a private IP, but it seems if the public DNS works the public IP should too since the public DNS is just a look up for the public IP.

It's working and all, but I'm confused. Could someone shed some light? I think I'm missing a basic building block of knowledge here.


To clarify, when I'm modifying the etc/ntp.conf, I'm doing it on the servers on my private subnet. The Public DNS (or IP) I'm referencing is the NAT's since they'll be using that server to sync their times. The NAT server is using the public NTP pool to keep its time on track.


You should not use your public IP for this. Doing so incurrs bandwidth charges and is not necessary.

If you really want to host your own NTP (which you really shouldn't do), create a DNS name for the private IP of your server and have your clients use that.

But really, you shouldn't do this. In order to have a healthy NTP setup, your clients should be polling three different servers. If I were you, I'd just configure your clients to use three servers from the NTP pool and be done with it. It's one less system for you to monitor and maintain.

  • Servers on private subnets do not have direct access to the internet. They get access via the NAT (which is in the public subnet of my VPC). The NAT is using three/four (forget exactly) from the NTP pool to keep its own time on track and then the private subnet servers are referring to it to keep their clocks on track. It's possible I've misunderstood the several articles I've read, so if any of the above seems off please let me know. – Morgan Jan 5 '16 at 18:40
  • Given the above being true, the question isn't why I shouldn't use the Public IP but why the Public IP would not work while the Public DNS does work. I am currently using the Public DNS, but my question is why using the Public IP simply doesn't work. Not why one shouldn't use it. – Morgan Jan 5 '16 at 18:41
  • What IP does the public DNS resolve to? – EEAA Jan 5 '16 at 18:46
  • The public IP. Which is why I'm confused. – Morgan Jan 5 '16 at 19:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.