ntpMerlin ntpMerlin - NTP Daemon for AsusWRT Merlin

[Jack Yaz]

@Jack Yaz

Is there a way to add the Min/Max/Avg to the UI like in your speedtest UI??

Thanks for the work!!

Press Toggle Lines

 

[peepsnet]

Press Toggle Lines

Ah...

 

[peepsnet]

I didnt see this in the OP.

On the Administration -> System under Basic Config :
What should the NTP Server option be set to if enabled at all???

 

[maghuro]

I didnt see this in the OP.

On the Administration -> System under Basic Config :
What should the NTP Server option be set to if enabled at all???

Anything.
It will be bypassed I think

 

[EmeraldDeer]

What I do not know but suspect is that the firmware BusyBox NTP client is used until the boot process is far enough along to allow ntpMerlin Entware NTP server to start.

If this is true, then

• Enable local NTP server set to No
  
• Time Zone and Daylight Saving information correctly entered
• NTP primary and secondary servers typed in

 

[peepsnet]

What I do not know but suspect is that the firmware BusyBox NTP client is used until the boot process is far enough along to allow ntpMerlin Entware NTP server to start.

If this is true, then

• Enable local NTP server set to No
  
• Time Zone and Daylight Saving information correctly entered
• NTP primary and secondary servers typed in

There is much logic in that

 

[Jack Yaz]

v2.4.0 is now available!
Changelog:

NEW: Change in minimum version requirement, see README!
NEW: Support for John's Fork of AsusWRT-Merlin (currently requires dev build, full support with next public release)
NEW: Option to toggle data output mode for weekly/monthly charts
NEW: Button to export/download CSVs used for charts
CHANGE: Raw data output is now the default
CHANGE: Migrated from datasource plugin for ChartJS to D3js library
REMOVED: Legacy WebUI code that would override unused ASP pages

 

[markusd1984]

Yesterday I tried v2.4.0 on RT-AC86U on 384.16 and i had to remove it as my internet stopped working since it used May 5th as a date instead of April 13th.

I tried updating it but that didn't work due to below error.

ntpMerlin: Downloading latest version () of ntpMerlin

ntpMerlin: New version of S77ntpd downloaded

/jffs/scripts/ntpmerlin: line 1085: /opt/etc/init.d/S77ntpd: not found

FYI - local NTP server is disabled, DST is set correctly and servers to pool.ntp.org and time.nist.gov

UPDATED:
Just read May 5th date appears during a router reboot, perhaps that's what happened.

I have it installed and I think it's working as the correct date is showing in the logs now and under System Log > General Log.
Would this be the best way to confirm?

 

[EmeraldDeer]

Yesterday I tried v2.4.0 on RT-AC86U on 384.16 and i had to remove it as my internet stopped working since it used May 5th as a date instead of April 13th.

I tried updating it but that didn't work due to below error.

ntpMerlin: Downloading latest version () of ntpMerlin

ntpMerlin: New version of S77ntpd downloaded

/jffs/scripts/ntpmerlin: line 1085: /opt/etc/init.d/S77ntpd: not found

FYI - local NTP server is disabled, DST is set correctly and servers to pool.ntp.org and time.nist.gov

UPDATED:
Just read May 5th date appears during a router reboot, perhaps that's what happened.

I have it installed and I think it's working as the correct date is showing in the logs now and under System Log > General Log.
Would this be the best way to confirm?

cat /opt/var/spool/ntp/ntp.log
cat /jffs/addons/ntpmerlin.d/ntp.conf
ntpq -p

 

[pirx73]

Hello. After recent upgrades (v2.4.0 - 2.4.1) ntpMerlin has stopped to intercept and answer to local LAN device requests on NTP.
When i try to sync time on my Windows PC either directly to router's IP or let's say ntp.pool.org i get error.
Wireshark shows that PC issues NTP packet towards router and does not receive anything. Router itself can communicate with NTP servers and get time.
Only when "redirect all NTP traffic to router" is enabled in ntpMerlin settings it does not work. If i disable that LAN devices can get time via NTP.
Log has nothing about this.

 

[Jack Yaz]

Hello. After recent upgrades (v2.4.0 - 2.4.1) ntpMerlin has stopped to intercept and answer to local LAN device requests on NTP.
When i try to sync time on my Windows PC either directly to router's IP or let's say ntp.pool.org i get error.
Wireshark shows that PC issues NTP packet towards router and does not receive anything. Router itself can communicate with NTP servers and get time.
Only when "redirect all NTP traffic to router" is enabled in ntpMerlin settings it does not work. If i disable that LAN devices can get time via NTP.
Log has nothing about this.

Router settings should be disabled. Can you share the output of

iptables -t nat -S PREROUTING

please?

 

[SomeWhereOverTheRainBow]

Hello. After recent upgrades (v2.4.0 - 2.4.1) ntpMerlin has stopped to intercept and answer to local LAN device requests on NTP.
When i try to sync time on my Windows PC either directly to router's IP or let's say ntp.pool.org i get error.
Wireshark shows that PC issues NTP packet towards router and does not receive anything. Router itself can communicate with NTP servers and get time.
Only when "redirect all NTP traffic to router" is enabled in ntpMerlin settings it does not work. If i disable that LAN devices can get time via NTP.
Log has nothing about this.

yea if these two rules are listed, then your ntp traffic is probably preferring to travel ipv6 vs ipv4 like ntpmerlin uses.

 

[Jack Yaz]

yea if these two rules are listed, then your ntp traffic is probably preferring to travel ipv6 vs ipv4 like ntpmerlin uses.

View attachment 22715

Any objections to me disabling IPv6 in that case?

 

[SomeWhereOverTheRainBow]

Hello. After recent upgrades (v2.4.0 - 2.4.1) ntpMerlin has stopped to intercept and answer to local LAN device requests on NTP.
When i try to sync time on my Windows PC either directly to router's IP or let's say ntp.pool.org i get error.
Wireshark shows that PC issues NTP packet towards router and does not receive anything. Router itself can communicate with NTP servers and get time.
Only when "redirect all NTP traffic to router" is enabled in ntpMerlin settings it does not work. If i disable that LAN devices can get time via NTP.
Log has nothing about this.

Here is what a successful connection to router ntp server looks like,

it shows the router intercepting the connection from the device and pointing it at router for the answer.

 

[SomeWhereOverTheRainBow]

Any objections to me disabling IPv6 in that case?

are you talking about an NTP IPV6 drop rule?

Maybe you should also include a IPV4 NTP drop rule from any where else for the redirect rule as well then.

 

[Jack Yaz]

are you talking about an NTP IPV6 drop rule?

Maybe you should also include a IPV4 NTP drop rule from any where else for the redirect rule as well then.

Dropping IPv4 shouldn't be needed if redirecting it. I'll look into ip6tables

 

[SomeWhereOverTheRainBow]

Router settings should be disabled. Can you share the output of

iptables -t nat -S PREROUTING

please?

Spoiler: adaptation of ipv4

iptables -t nat -D PREROUTING -p udp ! --source "$(nvram get lan_ipaddr)" ! --destination "$(nvram get lan_ipaddr)" --dport 123 -j DNAT --to "$(nvram get lan_ipaddr)" 2>/dev/null
iptables -t nat -D PREROUTING -p tcp ! --source "$(nvram get lan_ipaddr)" ! --destination "$(nvram get lan_ipaddr)" --dport 123 -j DNAT --to "$(nvram get lan_ipaddr)" 2>/dev/null
iptables -t nat -A PREROUTING -p udp ! --source "$(nvram get lan_ipaddr)" ! --destination "$(nvram get lan_ipaddr)" --dport 123 -j DNAT --to "$(nvram get lan_ipaddr)"
iptables -t nat -A PREROUTING -p tcp ! --source "$(nvram get lan_ipaddr)" ! --destination "$(nvram get lan_ipaddr)" --dport 123 -j DNAT --to "$(nvram get lan_ipaddr)"

is an interesting adaptation of your ipv4 rule, it redirects all traffic from ipv4 to and from 192.168.1.1 except traffic originating from 192.168.1.1
I am testing it atm.

/tmp/home/root# iptables -t nat -S PREROUTING

-A PREROUTING ! -s 192.168.1.1/32 ! -d 192.168.1.1/32 -p udp -m udp --dport 123 -j DNAT --to-destination 192.168.1.1
-A PREROUTING ! -s 192.168.1.1/32 ! -d 192.168.1.1/32 -p tcp -m tcp --dport 123 -j DNAT --to-destination 192.168.1.1

 

[SomeWhereOverTheRainBow]

Spoiler: adaptation of ipv4

iptables -t nat -D PREROUTING -p udp ! --source "$(nvram get lan_ipaddr)" ! --destination "$(nvram get lan_ipaddr)" --dport 123 -j DNAT --to "$(nvram get lan_ipaddr)" 2>/dev/null
iptables -t nat -D PREROUTING -p tcp ! --source "$(nvram get lan_ipaddr)" ! --destination "$(nvram get lan_ipaddr)" --dport 123 -j DNAT --to "$(nvram get lan_ipaddr)" 2>/dev/null
iptables -t nat -A PREROUTING -p udp ! --source "$(nvram get lan_ipaddr)" ! --destination "$(nvram get lan_ipaddr)" --dport 123 -j DNAT --to "$(nvram get lan_ipaddr)"
iptables -t nat -A PREROUTING -p tcp ! --source "$(nvram get lan_ipaddr)" ! --destination "$(nvram get lan_ipaddr)" --dport 123 -j DNAT --to "$(nvram get lan_ipaddr)"

is an interesting adaptation of your ipv4 rule, it redirects all traffic from ipv4 to and from 192.168.1.1 except traffic originating from 192.168.1.1
I am testing it atm.

/tmp/home/root# iptables -t nat -S PREROUTING

-A PREROUTING ! -s 192.168.1.1/32 ! -d 192.168.1.1/32 -p udp -m udp --dport 123 -j DNAT --to-destination 192.168.1.1
-A PREROUTING ! -s 192.168.1.1/32 ! -d 192.168.1.1/32 -p tcp -m tcp --dport 123 -j DNAT --to-destination 192.168.1.1

i get

with it and a successful ntp update every single attempt. no failures

 

[Jack Yaz]

Spoiler: adaptation of ipv4

iptables -t nat -D PREROUTING -p udp ! --source "$(nvram get lan_ipaddr)" ! --destination "$(nvram get lan_ipaddr)" --dport 123 -j DNAT --to "$(nvram get lan_ipaddr)" 2>/dev/null
iptables -t nat -D PREROUTING -p tcp ! --source "$(nvram get lan_ipaddr)" ! --destination "$(nvram get lan_ipaddr)" --dport 123 -j DNAT --to "$(nvram get lan_ipaddr)" 2>/dev/null
iptables -t nat -A PREROUTING -p udp ! --source "$(nvram get lan_ipaddr)" ! --destination "$(nvram get lan_ipaddr)" --dport 123 -j DNAT --to "$(nvram get lan_ipaddr)"
iptables -t nat -A PREROUTING -p tcp ! --source "$(nvram get lan_ipaddr)" ! --destination "$(nvram get lan_ipaddr)" --dport 123 -j DNAT --to "$(nvram get lan_ipaddr)"

is an interesting adaptation of your ipv4 rule, it redirects all traffic from ipv4 to and from 192.168.1.1 except traffic originating from 192.168.1.1
I am testing it atm.

/tmp/home/root# iptables -t nat -S PREROUTING

-A PREROUTING ! -s 192.168.1.1/32 ! -d 192.168.1.1/32 -p udp -m udp --dport 123 -j DNAT --to-destination 192.168.1.1
-A PREROUTING ! -s 192.168.1.1/32 ! -d 192.168.1.1/32 -p tcp -m tcp --dport 123 -j DNAT --to-destination 192.168.1.1

You shouldn't need to filter out traffic from the router itself, as the router won't be routing it's own traffic through the NAT table. I don't think it will, anyway

 

[SomeWhereOverTheRainBow]

You shouldn't need to filter out traffic from the router itself, as the router won't be routing it's own traffic through the NAT table. I don't think it will, anyway

I think it helps, as i am getting more successful NTP updates. might be a fluke, but it doesn't hurt to test to see if NTP interception improves.