NTP version installed: ntp-4.2.6p5-5

I'm trying to understand the usage and meaning of the ntp restrict along with restrict default nopeer

Quoting the NTP documentation:

nopeer: Deny packets that might mobilize an association unless authenticated. This includes broadcast, symmetric-active and manycast server packets when a configured association does not exist. It also includes pool associations, so if you want to use servers from a pool directive and also want to use nopeer by default, you'll want a "restrict source ..." line as well that does not include the nopeer directive. Note that this flag does not apply to packets that do not attempt to mobilize an association.

Does it mean, when we are using restrict default nopeer, we can't associate peers without authentication. (without using keys) ?

Consider the following scenario:

Server config: ip-

[root@sdp_1 ~]# cat /etc/ntp.conf

    #restrict default kod nomodify nopeer noquery notrap
    #restrict -6 default kod nomodify nopeer noquery notrap
    #restrict -6 ::1
    restrict default nopeer
    keys /etc/ntp/keys

Peer config: ip-

[root@sdp_2 ~]# cat /etc/ntp.conf

#restrict default kod nomodify nopeer noquery notrap
#restrict -6 default kod nomodify nopeer noquery notrap
#restrict -6 ::1
restrict default nopeer
peer minpoll 4
keys /etc/ntp/keys

Still i can see PEER associations at as below:

ntpq> associations

ind assid status  conf reach auth condition  last_event cnt
  1 48387  961a   yes   yes  none  sys.peer    sys_peer  1

[root@sdp_2 ~]# ntpq -np
     remote           refid      st t when poll reach   delay   offset  jitter
*     5 u   13   16  377    0.211    8.953   0.842

Are my assumptions are right ?

2 Answers 2


On your system, you have used the config

peer minpoll 4

This attempts to set up a two-way NTP relationship, i.e. will use as a time source, but it will also cause to tell "hey, you can use me as a server too if you wish".

Without the restrict default nopeer, after both systems had NTP running for a while, you would also see as a remote NTP source in ntpq -np listing of Since has only as its NTP source, would still prefer because of its better stratum value, but if connection to was lost, then and would both cross-check with each other to minimize time errors. (Or if was evil, it could use this two-way relationship to skew's clock further and further away from true time.)

The restrict default nopeer on tells it to not trust any NTP server that offers a two-way NTP relationship unless it is successfully authenticated (or explicitly listed in's ntp.conf), so it becomes a one-way client-server relationship instead. So still gets its time from, but if loses its connection to, it will not cross-check with and will rely on its own timekeeping only until connection to is restored.


The following is from man ntp_aac:

A default entry is also always present, though if it is otherwise unconfigured; no flags are associated with the default entry (i.e., everything besides your own NTP server is unrestricted).

Since the logic of ntp conf, restrict actually means permit. restrict default nomodify notrap nopeer noquery means does not permit any entry modify\trap\peer\query to this daemon. Even though this statement is omitted, it still comes into action.

  • If that is the case, in the above scenario I've configured restrict default nopeer ,and expecting peer association should not permit, Right? Feb 12, 2019 at 12:25
  • right. Unless you have other ristrict without nopeer, then that one is allowed to peer
    – Tiina
    Feb 13, 2019 at 6:51
  • @Tina, In above scenario which i tried, I've used only one 'restrict default nopeer' and remaining conf is commented... Feb 14, 2019 at 10:48
  • what does it mean to nopeer?
    – Avv
    Sep 15, 2022 at 21:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .