NTP unreachable due to firewall policy

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Time gradually drifts and distributed systems show auth failures and inconsistent logs.

Environment & Reproduction

chronyd running on RHEL 7 but chronyc sources show offline or unreachable peers.

Root Cause Analysis

Outbound or inbound UDP 123 blocked by host firewalld or upstream network ACL.

Quick Triage

Check chronyc sources -v and firewalld service list for ntp allowance.

Step-by-Step Diagnosis

Validate route and ACL path, inspect journalctl -u chronyd, and compare with a known-good host.

Solution – Primary Fix

Open ntp service in active zone and confirm chronyd syncs after restart.

Solution – Alternative Approaches

Use internal bastion NTP relay when direct internet NTP is prohibited.

Verification & Acceptance Criteria

chronyc tracking shows valid reference and offset remains within operational threshold.

Rollback Plan

Remove temporary firewall rules and restore prior chrony configuration.

Prevention & Hardening

Document NTP network dependencies in baseline firewall templates.

Related Errors & Cross-Refs

No usable sources, leap status not synchronized, authentication skew alerts.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

chronyc command reference, firewalld services docs, enterprise time sync standards.