From 8eb28c0a6bf0714fa38c396d43cbff8ecebff961 Mon Sep 17 00:00:00 2001 From: Audiobuzz Date: Fri, 10 Jul 2026 09:42:26 +0000 Subject: [PATCH] serving: document opening 123/udp on the host firewall for the NTP server MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The ntp service is host-networked, so (like the audit collector's 514/tcp) Docker doesn't open the port — the serving host's own ufw/firewalld governs 123/udp. Without a rule, workstations are handed 192.168.50.10 as their NTP server via DHCP opt 42 but their packets are dropped: chrony logs 'Added source … / unreachable' and never syncs (seen on comet-beacon-54). Add the boot-LAN firewall rule to the ntp service NOTE, mirroring the audit-collector README. --- serving/docker-compose.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/serving/docker-compose.yml b/serving/docker-compose.yml index bc9ab83..9e052ac 100644 --- a/serving/docker-compose.yml +++ b/serving/docker-compose.yml @@ -268,6 +268,14 @@ services: # HOST clock (the clock isn't namespaced) — intended: the serving host is the # lab time source. Drop SYS_TIME (and add `chronyd -x`) if the host already # runs its own NTP and you only want this to relay. + # + # FIREWALL (easy to miss — same trap as the audit collector's 514/tcp): host + # networking means Docker does NOT open the port; the serving host's own + # firewall governs 123/udp. Without a rule, workstations get 192.168.50.10 as + # their NTP server (DHCP opt 42) but their packets are dropped — chrony logs + # "Added source … / unreachable" and never syncs. Open it on the boot-LAN NIC: + # ufw: sudo ufw allow in on to any port 123 proto udp comment 'fleet NTP' + # firewalld: sudo firewall-cmd --permanent --add-service=ntp && sudo firewall-cmd --reload # --- Remote audit / log collector (RECEIVE side) --------------------------- # rsyslog receiver: booted diskless hosts (whose RAM-only overlay root loses