2

Network diagram http://www.gliffy.com/go/publish/6010719

We have a small-business grade NAT router, Draytek Vigor 2950. Devices behind the router are unable to communicate with NTP servers on the outside. This includes both Windows PCs, and our IP phones. All other services (DNS, HTTP, FTP, IMAP, SMTP, POP) function as expected.

I know that NTP (edit used to be "NAT") uses UDP port 123. I thought I wouldn't have to make any adjustments on the router in order for UDP to function properly; the NAT functionality should take care of it. Our IP phones (and some PCs) use SIP to initiate the connection; they work fine.

EDIT: I decided to test other UDP applications. Using the method suggested at https://support.safesoftsolutions.com/index.php?pg=kb.page&id=639 nothing gets through. I'm confused.

How can I further test?

  • What do you mean that NAT uses UDP port 123? Do you have PAT setup? Everything else is working? – Daniel Dib Jul 18 '14 at 18:36
  • en.wikipedia.org/wiki/Network_Time_Protocol says that NTP uses UDP port 123. I am not deliberately trying to translate any ports; no port mappings are set up in the router. I have not noticed anything else fail to work. – Snowbody Jul 18 '14 at 18:50
  • @DanielDib Now I'm not sure if other stuff is working. Shouldn't UDP work behind a NAT? How should I test it? – Snowbody Jul 18 '14 at 23:29
  • 1
    What's your topology? Draw a diagram. You were talking about NAT then you say you don't use NAT. What does your configuration look like? Can you reach anything at all? Do you have routing? There is too much information missing to give you any valid input. – Daniel Dib Jul 19 '14 at 4:51
  • @DanielDib network diagram added. I do use NAT. TCP works fine. – Snowbody Jul 30 '14 at 21:57
5

You updated to say that no UDP appears to be working.

I am not familiar with your product, but I have seen this type of behavior when the device uses a stateful firewall and it is configured to only allow inbound "established" traffic.

TCP will establish a connection, but UDP does not. To allow UDP return traffic, you typically have to allow "related" traffic in addition to established traffic.

5

Many NTP servers require the source of the query come from port 123, or they won't answer. I would say that's broken, but it doesn't change their behavior. (maybe ntp.org should pull them from the various pools.)

  • Good to know, but the machines are Windows and MacOS, and using those OS's built-in NTP clients, which are pre-configured from the factory to talk to the NTP servers run by the OS maker. NAT is widespread, and this doesn't seem to be a widespread problem (e.g. same notebooks work behind consumer NAT router at home). – Snowbody Aug 9 '17 at 17:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.