I notice that in /ip firewall connection tracking that the router is sending out UDP packets on port 123 to the active SNTP server address.
Could it be something in my firewall configuration is blocking SNTP?
[admin@obr1] > /ip firewall filter print detail
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; accept established connection packets
chain=input action=accept connection-state=established
1 ;;; accept related connection packets
chain=input action=accept connection-state=related
2 ;;; drop invalid packets
chain=input action=drop connection-state=invalid
3 ;;; allow access to router from known network
chain=input action=accept src-address-list=safe
4 ;;; detect and drop port scan connections
chain=input action=drop protocol=tcp psd=21,3s,3,1
5 ;;; suppress DoS attack
chain=input action=tarpit protocol=tcp src-address-list=black_list
connection-limit=3,32
6 ;;; detect DoS attack
chain=input action=add-src-to-address-list protocol=tcp
address-list=black_list address-list-timeout=1d connection-limit=10,32
7 ;;; jump to chain ICMP
chain=input action=jump jump-target=ICMP protocol=icmp
8 ;;; allow broadcast traffic
chain=input action=accept dst-address-type=broadcast
9 X ;;; allow all bit-torrent connections
chain=forward action=accept p2p=bit-torrent
10 chain=input action=log log-prefix="Filter:"
11 ;;; drop everything else
chain=input action=drop
12 X ;;; 0:0 and limit for 5pac/s
chain=ICMP action=accept protocol=icmp icmp-options=0:0-255 limit=5,5
13 X ;;; 3:3 and limit for 5pac/s
chain=ICMP action=accept protocol=icmp icmp-options=3:3 limit=5,5
14 X ;;; 3:4 and limit for 5pac/s
chain=ICMP action=accept protocol=icmp icmp-options=3:4 limit=5,5
15 X ;;; 8:0 and limit for 5pac/s
chain=ICMP action=accept protocol=icmp icmp-options=8:0-255 limit=5,5
16 X ;;; 11:0 and limit for 5pac/s
chain=ICMP action=accept protocol=icmp icmp-options=11:0-255 limit=5,5
17 ;;; drop invalid ICMP
chain=ICMP action=drop protocol=icmp
18 ;;; accept localhost
chain=services action=accept src-address=127.0.0.1 dst-address=127.0.0.1
First of all update routeros to RouterOs 6.15
Have you reboot the router so no do that
Disable firewall rules and look than if it works
If that not helps try with another ntp server
Because I couldn’t get any external NTP servers to work, I enabled the w32time service on my Windows 2008 server, and pointed the SNTP client on my routers to it, and bob’s your uncle! I now have SNTP on both my routers.
Still haven’t figured out the root cause of this issue (probably firewall), but this is good enough for me.
I too am having the same problem, the ntp client will not sync with the configured ntp servers. I tried disabling all firewall rules as well, but no-go. I have included my ntp client config as well as all firewall rules. Via Torch I am able to see incoming ntp packets on my WAN port but can’t see any (in or out) on the bridge interface. Any help in resolving this matter is appreciated. BTW, I am running RouterOS 6.15. The firewall config came from http://wiki.mikrotik.com/wiki/Basic_universal_firewall_script
Hello all,
I have been having this issue discuseed above when i connected to a new ISP. I discovered that all the places i installed mikrotik as hotspot, the time does not synch with ntp servers. Could it be that they blocked port 123 which ntp client uses.
Is there any workaround incase, they refused to unblock the port 123 (UDP/TCP), what other method will someone use assuming that, there is no computer to be used to setup as ntp server to synch the mikrotik ntp client.
Thanks as your help will be appreciated in this area.
I am fairly new to MT and I have a hard time getting the SNTP client to work. I have tried to search the forum, but have not found the solution to my problem so far. After reboot the date/time starts in jan 1970 and the sntp client setting does not correct this. BTW I’m also puzzled about the active server (I thought that should have been the primary or secondary stratum server ip address…
This ip addresses to ntp server, can you connect to that ??
If you have isp telia, you can’t connect to stupi.se, ask Peter Löthberg (http://sv.wikipedia.org/wiki/Peter_Löthberg) why.
I used the sytemt shut down from webfig and then powered it back on. No joy. Got the same ntp client print, but now the clock had lost the date/time and was back to 1970… Well it did not look like the ntp setting would correct it self, tried to disable/enable apply, no change. Tried then to set the clock manually (after about one hour), but so far no change…
The main question remains, how to ensure that my RB493G use the set primary or secondary ntp server ip?
For those who still have problems to get sntp or ntp synchronizing, and have been searching all day to resolve this
silly problem, use this code.
It is not highly sophisticated, but it does the job.
Adapt for your time zone, by substracting or adding in human phrasing in english.
You can disable ntp/sntp and just schedule this script.
greetings,
Richard
# This script copyright by Richard Kloostra
# You can use, modify, delete free of any charge
# Please submit modifications back to me. richard@riklsat.com
# last modified, Dec 12 2014 , v1.0
# Applies to ROS 6.23 / RB1100
# CREDITS
# Credit to www.timeapi.org
############
# Variables
############
:local newgmtmonstring ("newgmtmonstring"."txt")
:local gmtmonurl "http://www.timeapi.org/gmt/now?format=\\b"
:local mon
:local newgmtdaystring ("newgmtdaystring"."txt")
:local gmtdayurl "http://www.timeapi.org/gmt/now?format=\\d"
:local day
:local newgmtyearstring ("newgmtyearstring"."txt")
:local gmtyearurl "http://www.timeapi.org/gmt/now?format=\\Y"
:local year
:local datestring
:local newgmttimestring ("newgmttimestring"."txt")
:local gmttimeurl "http://www.timeapi.org/gmt/two+hours+ago?\\H:\\M:\\S"
:local gmttime
:local newgmtoffset ("newgmtoffset"."txt")
############
# Script
############
/tool fetch mode=http url=$gmtmonurl dst-path=$newgmtmonstring
:set mon [/file get ($newgmtmonstring) contents]
:log info ($mon)
/tool fetch mode=http url=$gmtdayurl dst-path=$newgmtdaystring
:set day [/file get ($newgmtdaystring) contents]
:log info ($day)
/tool fetch mode=http url=$gmtyearurl dst-path=$newgmtyearstring
:set year [/file get ($newgmtyearstring) contents]
:log info ($year)
/tool fetch mode=http url=$gmttimeurl dst-path=$newgmttimestring
:set gmttime [/file get ($newgmttimestring) contents]
:log info ($gmttime)
/system clock set date="$mon/$day/$year" time="$gmttime";
