RHEL 10 – chrony sources unreachable because firewalld egress rules block NTP – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Time synchronization repeatedly fails, causing auth and scheduling instability.

Environment & Reproduction

Seen in hardened environments with restrictive outbound firewall policies.

chronyc sources -v
chronyc tracking
firewall-cmd --list-all

Root Cause Analysis

firewalld policies deny UDP/123 egress to approved NTP servers.

Quick Triage

Validate chronyd status and network policy quickly.

systemctl status chronyd
chronyc activity
journalctl -u chronyd -n 60

Step-by-Step Diagnosis

Check direct UDP reachability and zone/policy assignments.

firewall-cmd --get-active-zones
firewall-cmd --query-service=ntp
tcpdump -ni any udp port 123 -c 10

Solution – Primary Fix

Allow NTP service in the correct zone and reload firewall.

firewall-cmd --zone=public --add-service=ntp --permanent
firewall-cmd --reload
systemctl restart chronyd

Solution – Alternative Approaches

Permit only specific NTP endpoints using rich rules for tighter controls.

firewall-cmd --permanent --add-rich-rule='rule family=ipv4 destination address=10.20.30.40 service name=ntp accept'
firewall-cmd --reload

Verification & Acceptance Criteria

chrony reaches sources and reports synchronized state.

chronyc sources -v
chronyc tracking
timedatectl status

Rollback Plan

Remove newly added firewall rule set if policy review rejects exposure.

firewall-cmd --zone=public --remove-service=ntp --permanent
firewall-cmd --reload

Prevention & Hardening

Maintain explicit allowlist for time infrastructure in firewall baselines.

firewall-cmd --permanent --list-all
chronyc sources

Related Errors & Cross-Refs

Associated with proxy-only egress models and DNS resolver failures.

Related tutorial: View the step-by-step tutorial for rhel-10.

View all rhel-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL firewalld and chrony integration best practices.