This is just some examples from my own NTP servers, there are many different ways to do this but here is mine:
# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default kod nomodify notrap noquery
restrict -6 default kod nomodify notrap noquery
# Set nopeer when not configuring a peer node.
#restrict default kod nomodify notrap nopeer noquery
#restrict -6 default kod nomodify notrap nopeer noquery
- noquery: prevent dumping status data from ntpd
- notrap: prevent control message trap service
- nomodify: prevent all ntpq queries that attempts to modify the
- nopeer: prevent all packets that attempts to establish a peer association
- Kod: set Kiss-o-death packet to reduce unwanted queries
- -6: informs ntpd that this is a restrict statement for IPV6 hosts (similar to: ping vs ping6)
Allow only trusted network hosts + localhost
restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap
restrict 127.0.0.1 #This is optional depending on your local machine's requirements
Difference between Server & Peer
- ntpd service requests the time from another server
- ntpd service exchanges the time with a fellow peer
ntp server A
server 0.pool.ntp.org iburst
server 1.pool.ntp.org iburst
ntp server B
server 2.pool.ntp.org iburst
server 3.pool.ntp.org iburst
- iburst: When the server is unreachable and at each poll interval, send a burst of eight packets instead of the usual one. As long as the server is unreachable, the spacing between packets is about 16s to allow a modem call to complete. Once the server is reachable, the spacing between packets is about 2s.
For the rest of the servers on your network that will connect to your ntp servers you can also use the
server 192.168.1.125 prefer # Prefer your own NTP server over others listed
One example of a multi-server/peer ntp network. Notice how each ntp does not have the same
servers listed. This is for better use of the peer sync. So peer sync can match against different time results.
1a 1b 1c 1d 1e 1f outside
. \ / ...... \ / ...... \ / ..............
2a ---p--- 2b ---p--- 2c inside
/|\ /|\ /|\
/ | \ / | \ / | \
3a 3b 3c 3e 3f 3g 3h 3i 3j
Key: 1 = stratum-1, 2 = stratum-2, 3 = stratum-3, p = peer
#Diagram + more info: http://www.ntp.org/ntpfaq/NTP-s-config-adv.htm
Hope that helps.